A git pre-commit hook that catches AWS keys, Stripe secrets, GitHub tokens, SSH keys and more before they leave your machine. Free. Zero network calls. Adds under 200ms to every commit.
$ npm install --save-dev @sealedkeys/scan
$ npx sealedkeys-scan install
✓ pre-commit hook installed
That's it. Every commit in this repo is now checked.
When a secret is found, the commit is blocked and you see exactly what matched — masked so the secret isn't exposed in your terminal history.
🔴 SealedKeys Scan blocked this commit
✗ src/config.js (line 14)
Stripe Secret Key: sk_l••••••••3456
✗ deploy/keys/id_rsa — blocked extension: .pem
2 issues found. Remove secrets before committing.
Store secrets securely: https://sealedkeys.com
False positive? Add the path to .sealedkeysscanignoreCovers the secrets that actually get committed — the ones that have caused real incidents.
The most common complaint with secret scanners is noise. Scan automatically allowlists patterns that are safe by design — no configuration required.
Runs as a git hook — before every git commit. Checks exactly what's being committed, not your working directory.
Runs git diff --cached --name-only to find exactly what you're committing — not your working directory.
Uses git show :filename to read each file at its staged revision. You can't sneak in a last-minute edit.
Each line is checked against 18 regex patterns. Safe values — process.env, template literals, placeholders — are allowlisted.
If anything matches, the commit is blocked with a clear error showing the file, line, and masked secret. Exit 0 if clean.
If a file legitimately contains something that matches — test fixtures, mock credentials, documentation — add it to .sealedkeysscanignore in your repo root.
# One path or pattern per line
tests/fixtures/
mocks/fake-credentials.js
docs/examples/$ npx sealedkeys-scan install # Install pre-commit hook
$ npx sealedkeys-scan uninstall # Remove the hook
$ npx sealedkeys-scan check # Run manually on staged files
$ npx sealedkeys-scan --help
No. Scan makes zero network calls. It reads staged files locally using git show and runs regex patterns in-process. Nothing leaves your machine.
No. process.env references, os.environ.get(), template literals and placeholder strings like your-api-key are automatically allowlisted. You won't get noise on environment variable lookups.
Under 200ms. It only reads staged content — not your entire working directory. On most repos the scan is imperceptible.
Add the file path or pattern to .sealedkeysscanignore in your repo root. One line per entry, # for comments.
Yes. The hook runs from the repo root, scans only staged files, and respects .sealedkeysscanignore patterns relative to the root.
SealedKeys gives your team somewhere safe to put it instead — a zero-knowledge vault for passwords, API keys and SSH keys.
Scan is free and open source. SealedKeys vault — free for up to 25 items, no credit card.