SecretScanBefore you publish

Forgotten secrets, found before the bots do.

Drop your project folder or paste a text: SecretScan shows where the keys and passwords are, how to revoke them, and gives you a copy with the secrets replaced.

€19Opening soon

incl. VAT · one-off · no subscription

Get notified All tools

● secretscan.html — offline

Screenshot of SecretScan: two secrets found in a text, values masked

25kinds of secrets recognised

0network requests

20 MBper text file

2languages, EN and FR

Features

Find, understand, clean up.

Scan a folder

Drop the whole folder: node_modules, .git and images are skipped. Sensitive files such as .env are flagged by name.

Know what to do

For each secret: the file, the kind, the masked value and where to revoke it at the provider (AWS, GitHub, Stripe, Google, Slack…).

Clean up

Download the report as CSV and a copy of the pasted text with the secrets replaced.

What you get

One file, two languages.

secretscan.zip: the page in English and French, a read-me and the licence.
Opens in any recent browser, even offline.
No account, no installation, no data sent.
The version you buy and fixes to its bugs.

What it does not do

Honest limits.

Detection by known patterns and by random-looking strings: there are false positives and false negatives.
Removing a secret from the code is not enough if it was already published: it must be revoked at the provider.
It does not read git history and does not replace a check built into your repository (pre-commit).

FAQ

Frequently asked questions

Are my files sent anywhere?

No. The scan runs in your browser and the page itself forbids any connection. Values found stay masked on screen.

Which secrets does it recognise?

25 kinds: AWS, Azure and Google keys, GitHub, GitLab, Slack, npm, Stripe and Shopify tokens, PEM private keys, JWTs, passwords written in code, URLs with credentials, and more. Plus strings that look like a randomly generated key.

When can I buy it?

Soon. Sign up below: one single message when sales open.

Waiting list

Get notified at launch.

Leave your e-mail and the tool you are interested in. One message when sales open, nothing else.

WebGuard Tools

The other tools

HookCheck

Webhooks

Checks a webhook signature (Stripe, GitHub, Shopify or generic) and explains why it is rejected: whitespace, line endings, reformatted JSON, wrong secret.

€12See the page →

$ python webhookninja.py serve --mode stripe --target http://127.0.0.1:3000/hook

$ python webhookninja.py list

1 done essais=1 ok

2 done essais=3 ok

3 rejected essais=0 refusee: signature differente

4 dead essais=6 ok HTTP 503

$ python webhookninja.py replay-dead

file morte remise en file

WebhookNinja Local

Webhooks · self-hosted

A webhook receiver you host yourself: signature checked, duplicates ignored, everything kept, forwarded with retries, replayed in one command.

For developers: Python 3.8 and a reachable machine.

€49See the page →

ChainProof

File integrity

Seals a set of files or a folder: a manifest of fingerprints and an overall fingerprint. Later, it tells you what is identical, modified, missing or added.

Proves integrity, not a legally binding date.

€19See the page →