Features
Secrets leak detection for small dev teams: scan the working tree and full git history for leaked credentials, with Slack alerts and revocation runbooks. $49/mo flat.
Working-tree scan
Scan any directory for 11 secret types: AWS keys, Stripe keys, GitHub tokens, private keys, database URLs, and more.
Git history scan
Walks git log to find secrets committed and later removed — the case working-tree scans miss.
Entropy heuristics
High-entropy token detection catches the secrets no regex knows about. Stated honestly: regex + entropy, never 'AI-powered'.
Redacted previews
Full secret values never appear in output, JSON reports, or Slack messages — previews are truncated by design.
Revocation runbooks
Per-secret-type ordered steps: rotate first, purge history second, audit the blast radius.
CI-ready JSON output
Exit 0 clean / 1 findings / 2 config error. Fail the build on leaked secrets.
Scheduled sweeps (Team+)
The sweep command runs the history scan on your own schedule — GitHub Actions and cron templates included — and Slack-alerts only on NEW findings. The first run sets a silent baseline, so there is no week-one alert flood.