# SecretSecurity

[![MIT License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
[![GitHub Sponsors](https://img.shields.io/badge/Sponsor-%E2%9D%A4-pink?logo=github)](https://github.com/sponsors/omegaleo)
[![Ko-fi](https://img.shields.io/badge/Ko--fi-Support%20me-FF5E5B?logo=ko-fi&logoColor=white)](https://ko-fi.com/omegaleo)

A .NET CLI tool that scans staged git changes for secrets, API keys, tokens, and sensitive credentials — and blocks commits when critical findings are detected.

## What it detects

| Type | Examples | Severity |
|------|----------|----------|
| Provider tokens | AWS access keys (`AKIA…`), Stripe live keys (`sk_live_…`), GitHub PATs (`ghp_…`), Slack tokens | Critical |
| Private keys | RSA, EC, OpenSSH private key blocks | Critical |
| Azure connection strings | `DefaultEndpointsProtocol`, `AccountKey` | Critical |
| Explicit secret assignments | `api_key=`, `token=`, `secret:` with a value | High |
| Database connection strings | General ADO.NET, Postgres/MySQL/MongoDB/Redis URLs | High |
| Suspicious blobs | High-entropy strings in suspicious context | Warning |

Dev-safe connections (localhost, 127.0.0.1, integrated security) are automatically ignored.

## Installation

Requires [.NET 10 SDK](https://dotnet.microsoft.com/download) or later.

```bash
dotnet tool install --global SecretSecurity
```

## Usage

### Install the pre-commit hook

Run once inside your repository:

```bash
secretsecurity install
```

This writes a `pre-commit` hook to `.git/hooks/` that runs `secretsecurity scan` automatically on every commit.

### Uninstall the pre-commit hook

```bash
secretsecurity uninstall
```

Removes the hook if it was installed by SecretSecurity. If the hook was created by something else, it is left untouched.

### Update

```bash
secretsecurity update
```

Updates the tool to the latest version via `dotnet tool update --global`.

### Scan manually

```bash
secretsecurity scan
```

Scans all currently staged changes (`git diff --cached`). Exits with code `1` if any High or Critical findings are found, blocking the commit.

### Ignore files

Create a `.secretsecurityignore` file in your repo root with one pattern per line:

```
tests/fixtures/
mock_secrets.json
```

Any staged file whose path contains a listed pattern is skipped.

## How it works

1. Runs `git diff --cached -U0` to get only the lines you are about to commit.
2. Each added line is checked against a set of compiled regex patterns ordered by confidence.
3. Matched values are partially masked in the output (e.g. `ghp_****Ab`).
4. If any finding is High or Critical, the scan exits with code `1`, preventing the commit.

## Building from source

```bash
git clone https://github.com/omegaleo/SecretSecurity.git
cd SecretSecurity
dotnet build
dotnet run --project SecretSecurity -- scan
```

## Contributing

Contributions are welcome! To get started:

1. Fork the repository and create a branch from `main`.
2. Make your changes and ensure the project builds (`dotnet build`).
3. Open a pull request describing what you changed and why.

Please open an issue first for any significant change so we can discuss the approach before you invest time in it.

## Support

If SecretSecurity saves you from an accidental secret leak, consider supporting its development:

- [GitHub Sponsors](https://github.com/sponsors/omegaleo) — sponsor directly on GitHub
- [Ko-fi](https://ko-fi.com/omegaleo) — buy me a coffee

## License

MIT — see [LICENSE.md](LICENSE) for details.