Static Code Analysis
Match secrets with your own regex.yaml ruleset
Regex ruleset scanner for directories and GitHub repositories; matches saved as JSON.
overview
What rex does
You need secret discovery driven by patterns you own, not a fixed detector list. rex (regexFinder) runs a regex.yaml (-r) across a local directory (-d) or a GitHub repository (-g).
Pass -t for private GitHub repos; -c sets thread count for large trees. Each hit is attributed to file and pattern and written as JSON for triage.
gitleaks and trufflehog ship prebuilt detectors and history or verification paths. secretfinder targets JS specifically. rex fits custom policy patterns. Pass -d or -g with -r; matches write as JSON to FILE plus FOLDER.
use cases
Where rex fits
Hunt secrets with custom patterns
Point rex at your own regex YAML so the scan looks for the exact key, token, and credential shapes that matter to your stack rather than a generic preset.
Scan private GitHub repositories
Provide a GitHub token and a repository name to fetch and scan code that is not public, catching leaked API keys before they reach a wider audience.
Run JSON-first triage
Collect matches as JSON keyed to file and pattern so a downstream node can filter, deduplicate, and route findings into a tracker.
Tune throughput on large trees
Raise the thread count so a deep directory or a large repository scans quickly without serializing every file.
reference
rex inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| directory-to-scan | FOLDER | -d | Local directory of files and folders to scan for secrets. |
| github-repo | STRING | -g | GitHub repository to fetch and scan for secrets. |
| regex-path | FILE | -r | Path to the regex.yaml ruleset that defines what to match. |
| gh_token | STRING | -t | GitHub token for scanning private repositories. |
| threads | STRING | -c | Number of threads to spread the scan across. |
Showing key inputs. rex exposes 5 inputs in total.
example
Run rex
# scan a GitHub repo against a custom regex ruleset, 20 threadsrex -g example/payments-api -t ghp_EXAMPLETOKEN0000 -r rules/secrets.yaml -c 20{ "aws-access-key-id": [ { "file": "config/settings.py", "line": 42, "match": "AKIAEXAMPLEKEY000000" } ], "generic-api-token": [ { "file": "src/api/client.js", "line": 118, "match": "token=EXAMPLE-b3f1-4a2c" }, { "file": "tests/fixtures/env.sample", "line": 7, "match": "sk_test_EXAMPLE000" } ], "rsa-private-key": [ { "file": "deploy/keys/id_rsa", "line": 1, "match": "-----BEGIN RSA PRIVATE KEY-----" } ]}guidance
Choosing rex
Use rex when secret discovery should follow your own regex ruleset against a directory or GitHub repository. Prefer gitleaks or trufflehog for prebuilt detectors and history or verification. Prefer secretfinder for JS-only secret extraction.
gitleaks
Ships a large built-in ruleset and scans git history; less reliant on hand-written patterns.
trufflehog
Detects credentials and verifies them against live providers.
secretfinder
Extracts secrets from JavaScript files rather than arbitrary directories.
faq
rex questions
related
More Static Code Analysis tools
bandit
AST-based security checks for Python source.
gitleaks
Detect hardcoded secrets in git repos and plain directories.
gosec
Go AST security scanner for credentials, crypto, and injection.
secretfinder
Regex scan of JavaScript for API keys, tokens, JWTs, and similar client-side secrets.
semgrep-scan
Static analysis with rules that look like the code they match.
trufflehog
Hunt leaked credentials and verify which still work.
Run rex yourself
A GitHub repository and a regex ruleset feed rex, which matches every pattern against the code and writes the found secrets as queryable JSON.
Facts on this page come from the live Trickest tool library.