Can rex scan private GitHub repositories?

Yes. Supply a GitHub token with -t alongside the -g repository name and rex authenticates, fetches the private code, and scans it. This is how you catch secrets in code that has been pushed to a private repo before it leaks further.

Can rex find leaked API keys and tokens?

It finds whatever your regex ruleset describes. Add patterns for AWS access keys, bearer tokens, or generic high-entropy strings to the regex YAML and rex reports every file that matches. Coverage equals the quality of the patterns you give it.

Where do rex's detection patterns come from?

You define them in a regex YAML file passed with -r. There is no built-in detector set, so the tool matches only the patterns you write, which keeps false positives under your control.

Is rex a static code analysis tool?

It is a lightweight static scanner: it pattern-matches secrets across files rather than parsing code semantics the way semgrep does. That makes it fast for credential discovery, but it will not reason about data flow or logic.

What format are rex's results in?

Matches are saved as JSON in a matches folder, each hit attributed to its file and pattern. Downstream Trickest nodes can read that file to filter, deduplicate, and route findings into an issue tracker.

Can I run rex on a schedule to catch new secrets early?

Yes. Put the rex node in a workflow and schedule it so every new commit to the target repositories gets scanned, then diff the JSON output to surface only newly introduced matches.

Updated Jul 14, 2026

Static Code Analysis

Scan repos and directories for secrets with a custom regex ruleset

Runs a regex ruleset across a directory or GitHub repository and saves matched secrets as JSON.

Hunt secrets with custom patterns Scan private GitHub repositories Run JSON-first triage

overview

What rex does

rex, also called regexFinder, runs a set of regular expressions across the files in a directory or a GitHub repository and records every hit as structured JSON. There is no fixed detector list: you supply the patterns in a regex YAML file, so the same engine hunts for AWS keys, bearer tokens, internal hostnames, or any string shape you can describe.

It reads a local folder or pulls a remote GitHub repository, and a GitHub token opens private repositories for scanning. Work spreads across a configurable thread count so a large tree finishes quickly, and each match stays attributed to its file and pattern for clean triage.

On Trickest, rex is a Static Code Analysis node that takes a target directory or repository plus a regex ruleset and writes a file and a folder of matches. Reach for it when you want to enforce a custom secret-pattern policy across the repositories your team owns, then route the JSON findings into a tracker.

source github.com/JaimePolop/RExpository

use cases

Where rex fits

Hunt secrets with custom patterns

Point rex at your own regex YAML so the scan looks for the exact key, token, and credential shapes that matter to your stack rather than a generic preset.

Scan private GitHub repositories

Provide a GitHub token and a repository name to fetch and scan code that is not public, catching leaked API keys before they reach a wider audience.

Run JSON-first triage

Collect matches as JSON keyed to file and pattern so a downstream node can filter, deduplicate, and route findings into a tracker.

Tune throughput on large trees

Raise the thread count so a deep directory or a large repository scans quickly without serializing every file.

reference

rex inputs and flags

5 inputs

Name	Type	Flag	Description
directory-to-scan	FOLDER	-d	Local directory of files and folders to scan for secrets.
github-repo	STRING	-g	GitHub repository to fetch and scan for secrets.
regex-path	FILE	-r	Path to the regex.yaml ruleset that defines what to match.
gh_token	STRING	-t	GitHub token for scanning private repositories.
threads	STRING	-c	Number of threads to spread the scan across.

Showing key inputs. rex exposes 5 inputs in total.

example

Run rex

rex · command

# scan a GitHub repo against a custom regex ruleset, 20 threadsrex -g example/payments-api -t ghp_EXAMPLETOKEN0000 -r rules/secrets.yaml -c 20

sample output

{  "aws-access-key-id": [    { "file": "config/settings.py", "line": 42, "match": "AKIAEXAMPLEKEY000000" }  ],  "generic-api-token": [    { "file": "src/api/client.js", "line": 118, "match": "token=EXAMPLE-b3f1-4a2c" },    { "file": "tests/fixtures/env.sample", "line": 7, "match": "sk_test_EXAMPLE000" }  ],  "rsa-private-key": [    { "file": "deploy/keys/id_rsa", "line": 1, "match": "-----BEGIN RSA PRIVATE KEY-----" }  ]}

guidance

Choosing rex

Use rex when you want to drive secret discovery from your own regex ruleset against a directory or GitHub repository. For prebuilt detector libraries with git-history support, gitleaks and trufflehog are stronger. For JS-specific secrets, secretfinder fits better.

gitleaks

Ships a large built-in ruleset and scans git history, less reliant on hand-written patterns.

trufflehog

Detects and then verifies credentials against their live providers.

secretfinder

Specializes in extracting secrets from JavaScript files rather than arbitrary directories.

faq

rex questions

Pass the repository with -g and your ruleset with -r, e.g. `rex -g example/payments-api -r rules/secrets.yaml`. On Trickest, set the node's github-repo and regex-path inputs instead of the flags. rex writes each match to a JSON file in the matches folder.

Run rex yourself

A GitHub repository and a regex ruleset feed rex, which matches every pattern against the code and writes the found secrets as queryable JSON.

Run rex in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

directory-to-scan

FOLDER

-d

Local directory of files and folders to scan for secrets.

github-repo

STRING

-g

GitHub repository to fetch and scan for secrets.

regex-path

FILE

-r

Path to the regex.yaml ruleset that defines what to match.

gh_token

STRING

-t

GitHub token for scanning private repositories.

threads

STRING

-c

Number of threads to spread the scan across.

{ "aws-access-key-id": [ { "file": "config/settings.py", "line": 42, "match": "AKIAEXAMPLEKEY000000" } ], "generic-api-token": [ { "file": "src/api/client.js", "line": 118, "match": "token=EXAMPLE-b3f1-4a2c" }, { "file": "tests/fixtures/env.sample", "line": 7, "match": "sk_test_EXAMPLE000" } ], "rsa-private-key": [ { "file": "deploy/keys/id_rsa", "line": 1, "match": "-----BEGIN RSA PRIVATE KEY-----" } ]}

Scan repos and directories for secrets with a custom regex ruleset

What rex does

Where rex fits

Hunt secrets with custom patterns

Scan private GitHub repositories

Run JSON-first triage

Tune throughput on large trees

rex inputs and flags

Run rex

Choosing rex

gitleaks

trufflehog

secretfinder

rex questions

More Static Code Analysis tools

bandit

dawnscanner

dumpsterdiver

dvcsripper-git

git-log4j

gitleaks

Run rex yourself

Scan repos and directories for secrets with a custom regex ruleset

What rex does

Where rex fits

Hunt secrets with custom patterns

Scan private GitHub repositories

Run JSON-first triage

Tune throughput on large trees

rex inputs and flags

Run rex

Choosing rex

gitleaks

trufflehog

secretfinder

rex questions

More Static Code Analysis tools

bandit

dawnscanner

dumpsterdiver

dvcsripper-git

git-log4j

gitleaks

Run rex yourself