Initial implementation

README.md

@@ -0,0 +1,96 @@
+# SecretSecurity
+
+[![MIT License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
+[![GitHub Sponsors](https://img.shields.io/badge/Sponsor-%E2%9D%A4-pink?logo=github)](https://github.com/sponsors/omegaleo)
+[![Ko-fi](https://img.shields.io/badge/Ko--fi-Support%20me-FF5E5B?logo=ko-fi&logoColor=white)](https://ko-fi.com/omegaleo)
+
+A .NET CLI tool that scans staged git changes for secrets, API keys, tokens, and sensitive credentials — and blocks commits when critical findings are detected.
+
+## What it detects
+
+| Type | Examples | Severity |
+|------|----------|----------|
+| Provider tokens | AWS access keys (`AKIA…`), Stripe live keys (`sk_live_…`), GitHub PATs (`ghp_…`), Slack tokens | Critical |
+| Private keys | RSA, EC, OpenSSH private key blocks | Critical |
+| Azure connection strings | `DefaultEndpointsProtocol`, `AccountKey` | Critical |
+| Explicit secret assignments | `api_key=`, `token=`, `secret:` with a value | High |
+| Database connection strings | General ADO.NET, Postgres/MySQL/MongoDB/Redis URLs | High |
+| Suspicious blobs | High-entropy strings in suspicious context | Warning |
+
+Dev-safe connections (localhost, 127.0.0.1, integrated security) are automatically ignored.
+
+## Installation
+
+Requires [.NET 10 SDK](https://dotnet.microsoft.com/download) or later.
+
+```bash
+dotnet tool install --global SecretSecurity --add-source https://nuget.pkg.github.com/omegaleo/index.json
+```
+
+## Usage
+
+### Install the pre-commit hook
+
+Run once inside your repository:
+
+```bash
+secretsecurity install
+```
+
+This writes a `pre-commit` hook to `.git/hooks/` that runs `secretsecurity scan` automatically on every commit.
+
+### Scan manually
+
+```bash
+secretsecurity scan
+```
+
+Scans all currently staged changes (`git diff --cached`). Exits with code `1` if any High or Critical findings are found, blocking the commit.
+
+### Ignore files
+
+Create a `.secretsecurityignore` file in your repo root with one pattern per line:
+
+```
+tests/fixtures/
+mock_secrets.json
+```
+
+Any staged file whose path contains a listed pattern is skipped.
+
+## How it works
+
+1. Runs `git diff --cached -U0` to get only the lines you are about to commit.
+2. Each added line is checked against a set of compiled regex patterns ordered by confidence.
+3. Matched values are partially masked in the output (e.g. `ghp_****Ab`).
+4. If any finding is High or Critical, the scan exits with code `1`, preventing the commit.
+
+## Building from source
+
+```bash
+git clone https://github.com/omegaleo/SecretSecurity.git
+cd SecretSecurity
+dotnet build
+dotnet run --project SecretSecurity -- scan
+```
+
+## Contributing
+
+Contributions are welcome! To get started:
+
+1. Fork the repository and create a branch from `main`.
+2. Make your changes and ensure the project builds (`dotnet build`).
+3. Open a pull request describing what you changed and why.
+
+Please open an issue first for any significant change so we can discuss the approach before you invest time in it.
+
+## Support
+
+If SecretSecurity saves you from an accidental secret leak, consider supporting its development:
+
+- [GitHub Sponsors](https://github.com/sponsors/omegaleo) — sponsor directly on GitHub
+- [Ko-fi](https://ko-fi.com/omegaleo) — buy me a coffee
+
+## License
+
+MIT — see [LICENSE.md](LICENSE) for details.