Static Code Analysis
Scan Git commit history for high-entropy secrets
Entropy-based secret scan across a Git repository's commit history.
overview
What reposcanner does
A secret was committed once, then deleted from HEAD. Checkout-only scanners miss it. reposcanner walks past commits so reverted API keys, tokens, and passwords still surface.
Pass -r for the repo, tune -e minimum Shannon entropy and -l max line length, then bound with -c commit count or -b branch when a full-history pass is too heavy.
gitleaks and trufflehog ship larger detector libraries and verification. reposcanner stays entropy-driven. Feed a repository reference; findings land as FILE plus FOLDER for org-wide sweeps.
use cases
Where reposcanner fits
Catch secrets removed from the working tree
Scan the full commit history so credentials that were committed and later deleted still surface, since they remain reachable in past commits.
Audit a specific branch
Point reposcanner at one branch with -b to review a feature line or release branch in isolation rather than the whole repository.
Tune entropy to cut noise
Raise the minimum entropy threshold with -e to focus on high-randomness strings and reduce false positives from ordinary code and config text.
Sweep many repositories in a pipeline
Feed a list of organization repositories through reposcanner so every codebase gets a history-level secret check on a schedule.
reference
reposcanner inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| repo | STRING | -r | Repo to scan. |
| count | STRING | -c | Number of commits to scan. Default: all. |
| branch | STRING | -b | Scan a specific branch. |
| length | STRING | -l | Maximum line length. Default: 5. |
| entropy | STRING | -e | Minimum entropy to report. Default: 4.3. |
| verbose | BOOLEAN | -v | Verbose. |
Showing key inputs. reposcanner exposes 6 inputs in total.
example
Run reposcanner
# scan full history of a public repo for high-entropy secretsreposcanner -r https://github.com/example-org/example-repo -e 4.3 -l 200 -v[+] Scanning https://github.com/example-org/example-repo[+] Branch: main[!] High entropy string found Commit: a1b2c3d4e5f60718293a4b5c6d7e8f901234abcd File: config/settings.py Line: 42 Entropy: 5.12 String: AKIAIOSFODNN7EXAMPLE[!] High entropy string found Commit: 9f3a1c2b7d4e5f60a1b2c3d4e5f6a7b8c9d0e1f2 File: .env.example Line: 8 Entropy: 4.91 String: sk_test_EXAMPLE00000000000000000000guidance
Choosing reposcanner
Reach for reposcanner when the target is Git commit history, not just the working tree. Prefer gitleaks or trufflehog when you need a larger ruleset or credential verification.
gitleaks
Rule plus entropy scanner with a large built-in ruleset and git-history support.
trufflehog
Scans history and live sources, then verifies found credentials against providers.
secretfinder
Targets secrets inside JavaScript files, not Git commit history.
faq
reposcanner questions
related
More Static Code Analysis tools
bandit
AST-based security checks for Python source.
gitleaks
Detect hardcoded secrets in git repos and plain directories.
gosec
Go AST security scanner for credentials, crypto, and injection.
secretfinder
Regex scan of JavaScript for API keys, tokens, JWTs, and similar client-side secrets.
semgrep-scan
Static analysis with rules that look like the code they match.
trufflehog
Hunt leaked credentials and verify which still work.
Run reposcanner yourself
A repository reference feeds reposcanner, which walks the commit history and writes any high-entropy secrets it finds as a queryable output.
Facts on this page come from the live Trickest tool library.