Catch secrets before you commit.

A fast secret scanner for Git hooks, repository audits, and AI coding agents. One binary. Works with built-in defaults.

brew install vshuraeff/tap/sekretbarilo
cd your-project && sekretbarilo install pre-commit

Documentation

Tutorial

Tutorials

Learn by doing

• Getting started
• Redact secrets in Claude Code tool output

How-to guide

How-to guides

Complete a task

• Installation
• Allowlist a confirmed false positive
• Audit Git history for secrets

Reference

Reference

Look up details

• CLI reference
• Configuration
• Rules reference

Explanation

Explanation

Understand the design

• How secret detection works
• Architecture
• Performance

What it catches

113 built-in rules in three tiers: prefix-based, context-aware, and a catch-all entropy tier. The values below are illustrative, not real detections; findings are always masked as first two plus last two characters.

• Cloud provider keys sk********7f
• Version control and CI tokens sk********7f
• Private keys and certificates sk********7f
• Database URLs and passwords sk********7f
• Generic high-entropy values sk********7f

For AI coding agents

In Claude Code, block mode refuses a Read of a file that carries a secret, while redact mode leaves the file alone and masks secrets in Bash, Read and Grep results.

In Codex CLI, a patch or shell command carrying a secret is blocked before it takes effect, and the hook runs only once you approve it with /hooks in the TUI.

Every agent hook mode ignores a .sekretbarilo.toml inside the repository until it is committed, because an agent that can write files could otherwise write itself a permissive config. Read the agent hooks reference.