Secret Gate
A release gate that knows your actual secrets: nothing ships until it finds nothing.
- Linux or macOS
- Python 3.9+
- Git hooks
- CI
What it does
Secret Gate answers one question before anything leaves your hands, whether it is a release zip, a customer's copy, an open-source push or the next commit: does this contain a secret of mine? It knows what your secrets are, because it reads the files where they live, and it never shows one: a finding names the file, the line and where the value came from.
- Your exact values. Every value in your env files, JSON and YAML configs,
.netrcand key files, looked for as written, base64-encoded and URL-encoded. A password that looks like an ordinary word, or an internal token with no known prefix, is caught like any other. - Secrets from machines it does not run on. Make fingerprints on your laptop; the build server finds those values without ever holding them.
- Other machines check against their own secrets. The files go to each machine over SSH, are scanned there and deleted. The secrets never move, and a machine that cannot answer blocks the release.
- Shapes, names and noise too. 25 token formats, your names, hosts, domains and account ids, private IP addresses, personal mail addresses, phone numbers, IBANs, home-folder paths, and random strings next to secret-ish names.
- It proves itself every time. Each scan starts by planting canaries of every kind; if any check misses its canary, the scan does not run.
- Where you already work. Folders, zip and tar archives, a git pre-commit or pre-push hook, exit codes for CI, a JSON report.
Tested on what we ship
- Every kit we sell: the 8 released archives scanned against the 133 secret values on our build machine and 16,259 fingerprints from our laptop. All passed, in 5.4 seconds together.
- A real secret planted in a release copy was caught plain and base64-encoded, each time named by the file it came from. The value appeared nowhere in the output or the report.
- A remote scan over SSH checked a release against a second machine's 499 secret values in 1.4 seconds, and caught a token planted in a copy that existed only on that machine.
What is inside
The gate
The four checks, the self-test, archive and git-staged scanning, a readable report and a JSON one.
Fingerprints
Fingerprints of one machine's secrets, for a scan on another, without the values.
Remote scans
The same files checked on every machine that holds secrets, with your project's rules sent along.
Setup and CI
A finder for your secret files, git hooks, and a GitHub Actions workflow for release archives.
Requirements
- Linux or macOS with Python 3.9 or newer; nothing to install from pip.
- Git for the hooks, SSH for remote scans.
Good to know
- It reads files as they are now. A secret already in your git history stays there: rotate it.
- Archives inside a scanned folder are not opened; scan each archive.
- Keep fingerprint files as private as the secrets: they hold the first 4 characters of each value of 16 characters or more.
Questions
How is this different from gitleaks or TruffleHog?
Those look for what secrets usually look like, and they are good at it. Secret Gate also knows what your secrets actually are: it reads your own secret files and looks for those exact values, so a database password or an internal token with no recognisable shape is caught too. It is built for one moment, before something ships, and fails closed.
Does it send my secrets anywhere?
No. Values are read from your files into memory for the scan and never printed, written or sent; a fingerprint file, if you make one, holds a hash and the first 4 characters of each. Remote scans send the files you are about to ship to your own machine; that machine's secrets stay on it.
What about false alarms?
A finding means "look at this". If it is fine, add a narrow allow rule for that kind of finding in the project's configuration, for example your own support address. There is no switch that turns a check off.
Can it scan my git history?
No. It checks what you are about to ship: a folder, an archive, or the next commit. For a secret that is already in history, rotate the secret.
Updated: