- Home
- Secrets Scanning Software
- scan4secrets
scan4secrets
What it is
scan4secrets is a free, MIT-licensed command-line tool for finding leaked credentials, vulnerabilities, and configuration problems. It scans source trees, running web applications, and CI logs, supporting teams that check code alongside live staging or production systems. The project lists 416 rules: 193 secret checks and 223 vulnerability or misconfiguration checks. Its SAST engine includes injection, SSRF, XSS, weak cryptography, JWT flaws, and infrastructure configuration issues. The web crawler parses JavaScript source maps for endpoints and scans response headers. Authenticated DAST accepts cookies, headers, and Burp or ZAP proxies, while optional verification probes vendor APIs to see whether tokens are live. Reports can be exported as SARIF, JSON, JSONL, CSV, HTML, Excel, or PDF. YAML files allow rule additions without code changes. Documented integrations cover pre-commit, GitHub Actions, GitLab CI, Jenkins, and Docker in CI. Linux and Windows are supported.
For and against
For
- 416 rules cover secrets and vulnerabilities
- Scans source, web apps, and CI logs
- Authenticated DAST supports proxy tools
- Exports reports in seven formats
- Custom YAML rules require no code changes
Against
- Command-line tool requires setup
- Default maximum file size is 10 MB
- Secret values appear unmasked by default
- Live verification is optional
The verdict
scan4secrets offers broad code, web, and CI scanning with customizable rules and many report formats. Teams should review its file and line limits and mask secrets before sharing reports.
Who it suits
It suits development and security teams scanning repositories, CI pipelines, and live web systems. Teams using GitHub, GitLab, or Bitbucket can add it alongside existing checks.
Plans and prices
MIT-licensed open-source CLI
MIT License · source, pipx, and Docker installation
Read 5 Oct 2026 · scan4secrets.m14r41.in
On the record
- Authenticated scans
- Authenticated DAST supports cookies, headers, and Burp or ZAP proxies.scan4secrets.m14r41.in · read 5 Oct 2026
- CI integrations
- The maker documents integration examples for pre-commit, GitHub Actions, GitLab CI, Jenkins, and Docker in CI.scan4secrets.m14r41.in · read 5 Oct 2026
- DAST
- Its web crawler parses JavaScript source maps, extracts endpoints, and scans response headers.scan4secrets.m14r41.in · read 5 Oct 2026
- Intended users
- The maker describes the tool as complementary to gitleaks for teams scanning live staging or production systems alongside source code.scan4secrets.m14r41.in · read 5 Oct 2026
- License
- The project is MIT licensed.scan4secrets.m14r41.in · read 5 Oct 2026
- Live verification
- An optional verification mode probes vendor APIs to check whether detected tokens are live.scan4secrets.m14r41.in · read 5 Oct 2026
- Performance limits
- The architecture page gives a default maximum file size of 10 MB and maximum line length of 4096 characters.scan4secrets.m14r41.in · read 5 Oct 2026
- Purpose
- The tool scans source trees, running web apps, and CI logs for leaked credentials, code vulnerabilities, and misconfigurations.scan4secrets.m14r41.in · read 5 Oct 2026
- Report masking
- Secret values appear in full by default, and the maker recommends using --mask before uploading reports to shared artifact stores.scan4secrets.m14r41.in · read 5 Oct 2026
- Reports
- Output formats include SARIF, JSON, JSONL, CSV, HTML, Excel, and PDF.scan4secrets.m14r41.in · read 5 Oct 2026
- Rule coverage
- It lists 416 rules: 193 secret rules and 223 vulnerability or misconfiguration rules.scan4secrets.m14r41.in · read 5 Oct 2026
- Rule customization
- Users can add secret and vulnerability rules by editing YAML files without changing code.scan4secrets.m14r41.in · read 5 Oct 2026
- Vulnerability coverage
- The SAST engine detects issues including injection, SSRF, XSS, weak cryptography, JWT flaws, and infrastructure configuration problems.scan4secrets.m14r41.in · read 5 Oct 2026
