Secret Scanner (VS Code Extension)
Detects hardcoded credentials in your code, reports them in a structured (JSON or
human-readable) format, and — via real git hooks — blocks git commit / git push
when a secret is found, no matter whether the push is triggered from VS Code's Source
Control view, the integrated terminal, or an external terminal.
Features
- Scan on save: every save re-scans the file and updates the Problems panel with
proper severity (Error / Warning / Information), a rule code, and source
Secret Scanner.
- Structured reports:
Secret Scanner: Show Report opens an output channel with a
report in text, json, or both — configurable via secretScanner.outputFormat.
- Workspace-wide scan:
Secret Scanner: Scan Entire Workspace walks the whole repo
(respecting secretScanner.ignoreGlobs) and produces one aggregate report.
- Git hook enforcement (the real blocking mechanism):
Secret Scanner: Install Git Hooks installs an actual pre-push hook (and an optional pre-commit hook) into
.git/hooks/. These run as plain Node scripts outside VS Code entirely, so they catch
a push regardless of what client/tool initiated it. On block, the offending file, line,
column, and rule are printed, and the push/commit is aborted with a non-zero exit code.
- Status bar indicator showing the live secret count for the current file.
- Inline suppression for a reviewed false positive: append
// secret-scanner-ignore-line
(or // scanner:ignore) to a line.
- Severity-aware blocking:
secretScanner.git.minSeverityToBlock lets you block on
critical/high findings only while still reporting medium/low ones.
- Emergency override:
SECRET_SCANNER_SKIP=1 git push bypasses the hook for a single
command (use sparingly, it's logged to hook output).
- Shared team policy: installing hooks writes a
.secretscannerrc.json to the repo
root. Commit that file so every teammate who installs the hook enforces the same rules.
Why git hooks, not the VS Code Git API?
VS Code's Git extension exposes no cancelable "before push" event — by the time any
push-related event fires, the push has already left the machine. A pre-push hook is the
only mechanism git itself guarantees will run, and will abort the push, before any commits
reach the remote — regardless of which tool (VS Code, CLI, another IDE) triggered it.
Configuration
| Setting |
Default |
Description |
secretScanner.outputFormat |
text |
text, json, or both |
secretScanner.scanOnSave |
true |
Re-scan on every save |
secretScanner.ignoreGlobs |
node_modules, dist, out, lockfiles, test-samples |
Paths excluded from scans |
secretScanner.git.blockPush |
true |
Whether the pre-push hook actually blocks |
secretScanner.git.blockCommit |
false |
Whether the pre-commit hook actually blocks (opt-in) |
secretScanner.git.minSeverityToBlock |
medium |
Minimum severity that triggers a block |
secretScanner.git.autoInstallHooks |
true |
Prompt to install hooks the first time a git repo opens |
Development
npm install
npm run compile # or: npm run watch
Press F5 in VS Code to launch an Extension Development Host.
To manually test the scanner logic without the hooks:
node scripts/testScan.js
Ideas for further hardening (not yet implemented)
- Entropy-based detection alongside regex, to catch high-entropy strings that don't
match a known credential format, and to reduce false positives on generic
KEY_VALUE-style
matches.
- Server-side enforcement (GitHub/GitLab push protection, or a CI job running the same
scanner) as a backstop for teammates who haven't installed the local hook, or who clone
the repo fresh and push before installing it.
- Quick Fix code actions to redact a detected secret and insert a
process.env.FOO
reference in one click.
.secretscannerignore file for path-based allowlisting, separate from inline
per-line suppression.- Secret rotation reminders: if a credential match is later removed from tracked files
but was previously pushed, flag that it's still live in git history and should be rotated.
| |
