loading
Loading content
loading
Static Code Analysis
Regex ruleset scanner for directories and GitHub repositories; matches saved as JSON.
overview
You need secret discovery driven by patterns you own, not a fixed detector list. rex (regexFinder) runs a regex.yaml (-r) across a local directory (-d) or a GitHub repository (-g).
Pass -t for private GitHub repos; -c sets thread count for large trees. Each hit is attributed to file and pattern and written as JSON for triage.
gitleaks and trufflehog ship prebuilt detectors and history or verification paths. secretfinder targets JS specifically. rex fits custom policy patterns. Pass -d or -g with -r; matches write as JSON to FILE plus FOLDER.
use cases
Point rex at your own regex YAML so the scan looks for the exact key, token, and credential shapes that matter to your stack rather than a generic preset.
Provide a GitHub token and a repository name to fetch and scan code that is not public, catching leaked API keys before they reach a wider audience.
Collect matches as JSON keyed to file and pattern so a downstream node can filter, deduplicate, and route findings into a tracker.
Raise the thread count so a deep directory or a large repository scans quickly without serializing every file.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| directory-to-scan | FOLDER | -d | Local directory of files and folders to scan for secrets. |
| github-repo | STRING | -g | GitHub repository to fetch and scan for secrets. |
| regex-path | FILE | -r | Path to the regex.yaml ruleset that defines what to match. |
| gh_token | STRING | -t | GitHub token for scanning private repositories. |
| threads | STRING | -c | Number of threads to spread the scan across. |
Showing key inputs. rex exposes 5 inputs in total.
example
# scan a GitHub repo against a custom regex ruleset, 20 threadsrex -g example/payments-api -t ghp_EXAMPLETOKEN0000 -r rules/secrets.yaml -c 20{ "aws-access-key-id": [ { "file": "config/settings.py", "line": 42, "match": "AKIAEXAMPLEKEY000000" } ], "generic-api-token": [ { "file": "src/api/client.js", "line": 118, "match": "token=EXAMPLE-b3f1-4a2c" }, { "file": "tests/fixtures/env.sample", "line": 7, "match": "sk_test_EXAMPLE000" } ], "rsa-private-key": [ { "file": "deploy/keys/id_rsa", "line": 1, "match": "-----BEGIN RSA PRIVATE KEY-----" } ]}guidance
Use rex when secret discovery should follow your own regex ruleset against a directory or GitHub repository. Prefer gitleaks or trufflehog for prebuilt detectors and history or verification. Prefer secretfinder for JS-only secret extraction.
Ships a large built-in ruleset and scans git history; less reliant on hand-written patterns.
Detects credentials and verifies them against live providers.
Extracts secrets from JavaScript files rather than arbitrary directories.
faq
related
AST-based security checks for Python source.
Detect hardcoded secrets in git repos and plain directories.
Go AST security scanner for credentials, crypto, and injection.
Regex scan of JavaScript for API keys, tokens, JWTs, and similar client-side secrets.
Static analysis with rules that look like the code they match.
Hunt leaked credentials and verify which still work.
A GitHub repository and a regex ruleset feed rex, which matches every pattern against the code and writes the found secrets as queryable JSON.
Facts on this page come from the live Trickest tool library.