{
  "slug": "secret-scanner",
  "name": "gizza-ai/secret-scanner",
  "version": "0.1.0",
  "title": "Secret Scanner — Find Hardcoded API Keys, Tokens & Private Keys in Code — gizza.ai",
  "description": "Paste code or config and flag hardcoded secrets — AWS, GitHub, Stripe, Google and other API keys, plus private-key headers. Runs in your browser, nothing uploaded.",
  "tags": [
    "secret scanner",
    "hardcoded secrets detector",
    "api key finder",
    "credential scanner",
    "leaked token detector",
    "private key detector",
    "gitleaks alternative online",
    "secrets detection"
  ],
  "category": "utilities",
  "urls": {
    "page": "https://gizza.ai/tools/secret-scanner/",
    "markdown": "https://gizza.ai/tools/secret-scanner/index.md",
    "descriptor": "https://gizza.ai/tools/secret-scanner/tool.json",
    "deep_link_example": "https://gizza.ai/tools/secret-scanner/?text=aws_secret_key%20%3D%20%22AKIAIOSFODNN7EXAMPLE%22&min_severity=all&redact=true&format=text"
  },
  "cli": "gizza tool secret-scanner 'aws_secret_key = \"AKIAIOSFODNN7EXAMPLE\"'",
  "tool": {
    "description": "Statically scan a code/config/text snippet for hardcoded secrets. Matches known provider prefixes — AWS access key IDs (AKIA…), GitHub tokens (ghp_…, github_pat_…), GitLab PATs (glpat-…), Slack tokens (xox…) and webhooks, Stripe keys (sk_live_…/sk_test_…), Google API keys (AIza…), OpenAI keys (sk-…), Twilio, SendGrid, npm, Shopify, and Square tokens — plus PEM private-key headers (-----BEGIN … PRIVATE KEY-----). It also flags JWT-shaped strings (medium) and generic keyword assignments (api_key/password/secret/token = \"…\") whose value has high Shannon entropy and isn't an obvious placeholder (medium). Each finding reports line, column, severity, a rule id, and the provider; matched values are redacted by default. Params: text (the snippet), min_severity (all|high), redact (bool, default true), format (text|json). It never runs the code, never contacts any provider, and never verifies whether a credential is live — a heuristic aid, not a guarantee. A clean result means nothing matched, not that the code is secret-free. Runs locally.",
    "parameters": {
      "additionalProperties": false,
      "properties": {
        "format": {
          "default": "text",
          "description": "Output format: text (default) a readable report, or json (structured findings).",
          "enum": [
            "text",
            "json"
          ],
          "type": "string"
        },
        "min_severity": {
          "default": "all",
          "description": "Which findings to report: all (default) shows high (named provider keys, private-key headers) plus medium (generic keyword+entropy assignments, JWT-shaped strings); high shows only the high-confidence findings.",
          "enum": [
            "all",
            "high"
          ],
          "type": "string"
        },
        "redact": {
          "default": true,
          "description": "When true (default), matched secret values are masked in the output — only a short non-secret prefix is shown. Set false to reveal the full matched value.",
          "type": "boolean"
        },
        "text": {
          "description": "The code, config, or text to scan for hardcoded secrets (one or more lines).",
          "type": "string"
        }
      },
      "required": [
        "text"
      ],
      "type": "object"
    }
  }
}