History

Ajax Davis 5c9f1a1d0a chore: update dependencies with compatibility fixes - Update all packages to latest versions via pnpm update --latest - Downgrade Prisma 7 to 6 (v7 requires schema migration) - Downgrade Tailwind CSS 4 to 3 (v4 requires PostCSS migration) - Downgrade Storybook 10 to 8 (addons not available in v10) - Pin cheerio to 1.0.0-rc.12 via pnpm override (type exports changed) - Fix AI SDK tool definitions: parameters -> inputSchema - Fix cheerio types in extract-meta and table-extract tools - Add explicit type annotations to tool execute functions - Migrate biome config to v2.3.11 schema All type-checks, tests, and builds pass.		2026-01-09 22:49:41 +10:00
..
src	feat: add 100+ official TPMJS tools	2025-12-31 22:55:56 +10:00
CHANGELOG.md	chore: version packages	2025-12-31 23:54:47 +10:00
package.json	chore: update dependencies with compatibility fixes	2026-01-09 22:49:41 +10:00
README.md	feat: add 100+ official TPMJS tools	2025-12-31 22:55:56 +10:00
tsconfig.json	feat: add 100+ official TPMJS tools	2025-12-31 22:55:56 +10:00
tsup.config.ts	feat: add 100+ official TPMJS tools	2025-12-31 22:55:56 +10:00

README.md

@tpmjs/tools-secret-scan-text

Scan text for potential secrets using regex patterns.

Features

Detects the following types of secrets:

AWS Credentials: Access keys, secret keys, account IDs
GitHub Tokens: Personal access tokens, OAuth tokens
Slack Tokens: Bot tokens, webhooks
OpenAI API Keys: API keys for OpenAI services
Stripe API Keys: Live and restricted keys
Generic API Keys: Common API key patterns
JWT Tokens: JSON Web Tokens
Private Keys: RSA, EC, DSA, OpenSSH, PGP
Database Credentials: PostgreSQL, MySQL, MongoDB connection strings
Hardcoded Passwords: Password assignments in code
Google API Keys: Google Cloud API keys
Twilio API Keys: Twilio service keys
SendGrid API Keys: SendGrid API tokens
Mailchimp API Keys: Mailchimp API tokens
Bearer Tokens: Authorization bearer tokens

Installation

npm install @tpmjs/tools-secret-scan-text

Usage

import { secretScanText } from '@tpmjs/tools-secret-scan-text';

const code = `
const AWS_ACCESS_KEY = "AKIAIOSFODNN7EXAMPLE";
const apiKey = "sk-proj-1234567890abcdef";
const dbUrl = "postgres://user:password123@localhost:5432/mydb";
`;

const result = await secretScanText.execute({ text: code });

console.log(result);
// {
//   secrets: [
//     {
//       type: 'aws-access-key',
//       value: 'AKIAIOSFODNN7EXAMPLE',
//       line: 2,
//       column: 24,
//       context: '...const AWS_ACCESS_KEY = "AKIAIOSFODNN7EXAMPLE";...',
//       severity: 'critical'
//     },
//     {
//       type: 'openai-api-key',
//       value: 'sk-proj-1234567890abcdef',
//       line: 3,
//       column: 17,
//       context: '...const apiKey = "sk-proj-1234567890abcdef";...',
//       severity: 'critical'
//     },
//     {
//       type: 'postgres-connection',
//       value: 'postgres://user:password123@localhost:5432/mydb',
//       line: 4,
//       column: 17,
//       context: '...const dbUrl = "postgres://user:password123@localhost:5432/mydb";...',
//       severity: 'critical'
//     }
//   ],
//   secretCount: 3,
//   patterns: [
//     { type: 'aws-access-key', count: 1 },
//     { type: 'openai-api-key', count: 1 },
//     { type: 'postgres-connection', count: 1 }
//   ],
//   metadata: {
//     linesScanned: 5,
//     scanDurationMs: 2
//   }
// }

Severity Levels

critical: Immediate security risk (AWS keys, private keys, database credentials)
high: Serious risk (API keys, tokens, hardcoded passwords)
medium: Moderate risk (account IDs, less sensitive tokens)
low: Minor concerns

Use Cases

Pre-commit Hooks: Scan code before committing
CI/CD Pipelines: Detect secrets in build artifacts
Code Reviews: Identify hardcoded credentials
Log Analysis: Find accidentally logged secrets
Configuration Audits: Check config files for sensitive data

License

MIT