SecretLens — Secret Scanner

SecretLens is a local-first VS Code extension that detects potential API keys, credentials, tokens, private keys, and credential-bearing connection strings in your workspace.

Privacy: SecretLens scans your files locally. It does not upload source code or detected secrets to any external service.

Installation

Install SecretLens — Secret Scanner from the VS Code Marketplace by searching for PQRHoldings.secretlens-scanner. For local testing, open the Extensions view, choose Install from VSIX…, and select the packaged .vsix file.

Features

• Cancellable workspace scans with bounded concurrency, plus explicit active-file scans
• A modern, theme-aware sidebar with one-click scans, live progress, severity-first results, exact-location navigation, and Diagnostics
• Masked previews and fingerprint-only persistence—raw matched values are not stored or logged
• Binary, generated, lockfile, size, count, severity, and custom exclusion controls
• Provider-specific and contextual rules with placeholder and entropy filtering
• Atomic result replacement, durable ignores, progress throttling, and configurable scan timeouts

Open the SecretLens Activity Bar icon and choose Scan Workspace, or run SecretLens: Scan Workspace from the Command Palette. The sidebar keeps scan status, results, and the actions you need in one place. Findings are grouped by file and ordered by severity; select one to open and highlight its exact source range.

SecretLens scans only when you explicitly run a scan command. It does not watch files, scan on save, intercept commits, install Git hooks, or run workspace scripts.

Supported categories

AWS, Azure Storage, Google, GitHub, GitLab, OpenAI, Anthropic, Hugging Face, Stripe, Slack, npm, PyPI, SendGrid, Twilio, private-key headers, bearer credentials, credential-bearing PostgreSQL/MySQL/MariaDB/MongoDB/Redis/AMQP URLs, and contextual secret assignments in source code, JSON, YAML, TOML, and environment files.

Configuration and ignores

Search Settings for SecretLens to adjust maximum file size/count, concurrency, timeout, severity, Diagnostics, and workspace-discovery include/exclude globs. Use result context menus to ignore a finding or file. Run SecretLens: Reset Workspace Ignores to clear those rules; rescan the workspace to restore ignored-file findings. Ignored fingerprints and sanitized findings are stored in VS Code workspace state; raw secrets are not.

Limitations

Secret detection is heuristic and can produce false positives or false negatives. SecretLens does not detect every possible secret, validate credentials over a network, scan Git history, monitor files automatically, or intercept commits. A clean scan is not proof that a repository is secure.

SecretLens currently targets desktop VS Code 1.95 or later. It does not run as a browser extension in vscode.dev.

Development

npm install
npm run compile
npm test
npm run lint
npm run build
npm run test:integration
npm run package

Support, security, and contributing

For help with SecretLens, email partners@pqr.llc or open a GitHub issue that does not contain sensitive data. See SUPPORT.md for support guidance, SECURITY.md for private vulnerability reporting, and CONTRIBUTING.md for development rules.

License

MIT — see LICENSE.