- Home
- Secrets Scanning Software
- Secretlint
Secretlint
What it is
Secretlint is a free, MIT-licensed linting tool that scans projects for credentials and helps prevent them from reaching Git commits. Its CLI accepts files, glob patterns, or standard input, while default lint messages mask secret values to reduce exposure in terminals and logs. Rules are separate modules, and custom detectors can be published as npm packages. Documented pre-commit integrations include Husky and lint-staged, pre-commit, and Git hooks. GitHub Actions usage can add pull-request annotations through the GitHub formatter. The project also lists Mega-Linter, SARIF output, a macOS clipboard app, and a browser extension. That WebExtension connects with Chrome and Firefox DevTools to flag credentials in requests and responses. Installation options include Node.js, Docker, or a standalone executable without Node.js. The Node.js route requires version 22 or later. Secretlint does not automatically fix findings, though a formatter can mask secrets in an input file. Bug and feature requests go through GitHub issues.
For and against
For
- Masks secret values in lint errors by default
- Supports custom npm-based detection rules
- Integrates with pre-commit hooks and GitHub Actions
- Offers Docker and standalone executable options
- Includes browser and SARIF integrations
Against
- Does not automatically fix detected secrets
- Node.js installation requires version 22 or later
- GitHub issue tracker handles support requests
The verdict
Secretlint offers flexible credential scanning across local, Git, CI, and browser workflows. Its lack of automatic remediation means findings still require manual handling.
Who it suits
Secretlint suits developers and teams adding credential checks to Git workflows, CI, pull requests, or browser debugging. It also fits users who need custom detection rules or Node-free execution.
Plans and prices
Secretlint
MIT-licensed project; no paid plans or pricing stated
Read 9 Oct 2026 · github.com
On the record
- Additional integrations
- The README lists Mega-Linter, a browser extension, a macOS clipboard app, and SARIF formatter support.github.com · read 9 Oct 2026
- Browser extension
- The WebExtension integrates with Chrome and Firefox DevTools to help web developers notice credentials in requests and responses.github.com · read 9 Oct 2026
- CI integration
- The documentation shows running Secretlint in GitHub Actions and emitting pull request annotations with the GitHub formatter.github.com · read 9 Oct 2026
- Installation
- Secretlint can be installed with Node.js, run in Docker, or used as a single-executable binary that does not require Node.js.github.com · read 9 Oct 2026
- License
- The repository states that Secretlint is licensed under MIT.github.com · read 9 Oct 2026
- Notable limitation
- Secretlint does not automatically fix detected secrets, although its mask-result formatter can mask secrets in an input file.github.com · read 9 Oct 2026
- Pre-commit
- The project documents pre-commit integrations with Husky and lint-staged, pre-commit, and Git hooks.github.com · read 9 Oct 2026
- Purpose
- Secretlint is a pluggable linting tool to find credentials in projects and prevent committing them.github.com · read 9 Oct 2026
- Rules
- Rules are separate modules, and users can create custom rules as npm packages.github.com · read 9 Oct 2026
- Runtime requirement
- The Node.js installation instructions require Node.js 22 or later.github.com · read 9 Oct 2026
- Scanning
- The CLI scans files or glob patterns and supports stdin input.github.com · read 9 Oct 2026
- Secret masking
- Secret values are masked in lint error messages by default to help prevent exposure in logs and terminal output.github.com · read 9 Oct 2026
- Support
- The README directs users to create a GitHub issue for bugs and feature requests.github.com · read 9 Oct 2026
