SecretGuard
Local real-time scanner for common API keys, tokens, and credential patterns.
What It Does
SecretGuard scans files for 13 common credential patterns and surfaces local findings in VS Code's Problems panel. Scans can run on save, while typing, or on demand across the workspace.
Features
| Feature |
Description |
| Scan on Save |
Automatic scan every time a file is saved |
| Workspace Scan |
Full sweep on demand via command or right-click |
| Problems Panel |
Findings appear as errors/warnings with line numbers for quick navigation |
| Severity levels |
Critical (private keys), High (API tokens), Medium (passwords), Low (URL credentials) |
| Local Ignore Patterns |
Workspace-relative glob exclusions for test fixtures, example files, and known-safe references |
| Right-click menus |
Right-click any file → Scan File or Add Ignore Pattern; right-click a folder → Scan Workspace |
Detected Patterns
| Pattern |
Severity |
| RSA / EC / PGP Private Keys |
Critical |
| OpenAI API Key |
High |
| Replicate API Token |
High |
| GitHub PAT / OAuth Token |
High |
| Azure API Key |
High |
| AWS Access Key ID |
High |
| Generic Password |
Medium |
| Generic Secret |
Medium |
| Database Connection String |
Medium |
| URL with Embedded Credentials |
Low |
Local Ignore Patterns
Use SecretGuard: Add Ignore Pattern to add a workspace-relative glob to secretGuard.ignorePatterns, for example **/*.fixture.ts or docs/examples/**. Ignored files are skipped by on-type, on-save, current-file, and workspace scans. The setting is written to VS Code workspace settings; SecretGuard does not create a .secretguardignore file.
Scope and limitations
This is a regex-based local warning tool, not a replacement for server-side secret scanning or a pre-commit hook. Findings are potential secrets and should be reviewed before taking action. Audit-log match text is redacted.
Requirements
No external tools required. The scanner engine runs entirely within VS Code.
Commands
| Command |
Where |
Description |
SecretGuard: Scan Workspace |
Palette · Explorer right-click |
Scan all workspace files |
SecretGuard: Scan Current File |
Palette · Right-click any file |
Scan the active editor |
SecretGuard: View Audit Report |
Palette · Editor right-click |
Show output channel log |
SecretGuard: Add Ignore Pattern |
Palette · Right-click any file |
Exclude a glob pattern |
From the extension author: Loop Engineering: A Better Way to Think, Create, and Work with AI offers a practical framework for boundaries and verifiable safeguards in AI-assisted work.
Explore more tools from the same suite:
| Extension |
Description |
Marketplace |
| AI Voice Reader |
Read files, selections, or documents aloud with Web Speech API |
Install ↗ |
| Brandfetch Logo Fetcher |
Fetch and insert brand logos from any domain — SVG, PNG, or Markdown |
Install ↗ |
| Dev Wellbeing |
Local screen-break, posture, and hydration reminders |
Install ↗ |
| Focus Timer |
Pomodoro-style focus and break timer with status bar countdown |
Install ↗ |
| Gamma Slide Assistant |
Create presentations with local Marp export or optional Gamma generation |
Install ↗ |
| Hook Studio |
Visual editor for VS Code hook conditions and automation rules |
Install ↗ |
| Knowledge Decay Tracker |
Track staleness of documentation and flag overdue reviews |
Install ↗ |
| Markdown to Word |
Convert Markdown + Mermaid diagrams to .docx via Pandoc |
Install ↗ |
| MCP App Starter |
Scaffold Model Context Protocol servers in TypeScript, JavaScript, or Python |
Install ↗ |
| Mermaid Diagram Pro |
Preview, export, and validate Mermaid diagrams in Markdown files |
Install ↗ |
| PPTX Builder |
Generate PowerPoint presentations from Markdown using pptxgenjs |
Install ↗ |
| Replicate Image Studio |
Generate images and videos with FLUX, SDXL, and WAN via Replicate API |
Install ↗ |
| SecretGuard (this) |
Scan workspaces and files for accidentally committed secrets and keys |
Install ↗ |
| SVG to PNG |
Convert SVG files to PNG using resvg-js (Rust renderer, no ImageMagick) |
Install ↗ |
| SVG Toolkit |
Preview, copy as data URI, and validate SVG files in-editor |
Install ↗ |
| Workspace Watchdog |
Monitor file health, detect stalled work, and surface hot files |
Install ↗ |
License
MIT
