Free for developers. Powerful for teams. Credfence finds hardcoded secrets in your code—locally, in CI, or across your entire Git history. Build the Free edition for head scans, or Pro for deep history and live verification.
$ credfence scan git@private.company.com/repo.git \\\n --format sarif \\\n --verify --notify-slack \$WEBHOOK_URL
Scanning HEAD...
Files scanned: 1,247 | Findings: 3
[HIGH] github-pat in config/env.yaml:12
[HIGH] aws-access-key in deploy/terraform.tf:45
[LOW] generic-secret in .env.example:3
Verification:
github-pat: VERIFIED (still active!)
aws-access-key: revoked
Exit code: 1 (secrets found)From regex detection to live verification and CI/CD alerting
AWS, Azure, GCP, AI keys, databases, payments, messaging, crypto — 17 categories detected out of the box, with the 74-rule pack compiled into the binary.
Pro tier checks if leaked keys are still active via provider APIs (GitHub, AWS, GitLab, Stripe, Slack).
Scans every blob in every commit. Also scans inside zip, tar, tar.gz archives with annotated paths.
Console (colorized), JSON, SARIF, CSV, JUnit XML — ready for any CI/CD pipeline or security dashboard.
Reads your .gitignore, supports fingerprint baselines, incremental scanning (--since), and glob-based ignores.
Pro tier notifies your team on Slack or via email when secrets are found. No more silent leaks.
One-line install on macOS, Linux and Windows — drop it into any pipeline or pre-commit hook. Exit codes: 0=clean, 1=leaks, 2=error.
CREDFENCE_LOG_FORMAT=json for observability in Datadog, Grafana, or ELK. Track scan metrics over time.
Multi-tenant SaaS dashboard: severity charts, scan history, findings, licenses, and per-org worker API keys.
Four steps to prevent credential leaks
One command for macOS, Linux and Windows. No compiler needed.
Head scans are free. Deep history, diff, and live verification are Pro. 74 built-in rules, 17 categories.
Structured output with severity, entropy, masking, and fingerprints.
Pro tier sends Slack/email. CI exit codes gate deploys.
Build the Free edition for head scans, or thePro edition for deep history, live verification and the team dashboard. The Free build ships no licensing code.
Head scans for developers and CI pipelines.
# macOS / Linux curl -fsSL https://credfence.com/install.sh | sh # Windows (PowerShell) irm https://credfence.com/install.ps1 | iex
Full history, verification and the team dashboard.
Included with a Pro license. Sign in to download the licensed build from your dashboard.
Get Pro| Capability | Free | Pro |
|---|---|---|
| Head scans (working tree + directories) | ||
| 74 built-in rules across 17 categories (embedded) | ||
| Console / JSON / SARIF / CSV / JUnit output | ||
| Baseline, .gitignore + archive scanning | ||
| Docker, GitHub Action, pre-commit | ||
| Deep history + diff scans | ||
| Live secret verification | ||
| SaaS worker + team dashboard |
74 built-in rules shipped inside the binary. Add your own YAML rules with keyword gating, entropy thresholds, and allowlists.
Production-grade rules with keyword gating, entropy minimums, and allowlists to minimize false positives. 17 categories: AI, Cloud, SaaS, Databases, Payments, Messaging, Infra, Crypto, and more. Compiled into the binary as a compressed pack, so there is no rules folder to install or leak - credfence list-rules shows the whole catalogue.
- id: openai-api-key
name: OpenAI API Key
severity: high
secret_group: ai
pattern: 'sk-[A-Za-z0-9]{20,60}'
keywords:
- openai
- OPENAI_API_KEY
- sk-
entropy_min: 4.0
enabled: trueCreate rules for your internal secrets. Keyword gate reduces noise. Entropy threshold filters low-quality matches. Allowlists suppress known test values. Merge them on top of the built-ins with --rules-extra ./my-rules, replace the set with --rules ./my-rules, or override a single built-in rule by reusing its id.
- id: internal-jwt-secret
name: Internal JWT Signing Key
severity: critical
secret_group: custom
pattern: 'MYCOMP_[A-Za-z0-9+/=]{32,}'
keywords:
- MYCOMP_
- jwt_secret
- SIGNING_KEY
entropy_min: 4.5
allowlist:
values:
- mycomp-example-key-000000000000
enabled: trueYour rules stay as readable YAML in your repo, under version control. The built-in pack is compiled into the binary, so the corpus cannot be copied out of the archive.
Drop into any pipeline in minutes
Credfence outputs SARIF, JSON, CSV, JUnit, or colorized console. Exit code 1 blocks the pipeline when secrets are found.
- name: Install Credfence run: curl -fsSL https://credfence.com/install.sh | sh - name: Secret scan run: credfence scan . --format sarif
secret_scan:
image: ghcr.io/credfence/credfence:latest
script:
- credfence scan . --format sarif
--output results.sarifDeveloper-first. Freemium model. No lock-in.
Free CLI with 74 built-in rules (embedded), unlimited scans. Pro adds live verification (GitHub, AWS, GitLab, Stripe, Slack), Slack/email alerts, and team dashboards.
Credfence runs entirely on your infrastructure. Free tier is 100% local. Pro verification sends only token hashes to provider APIs — no source code.
Catch secrets in pre-commit hooks, CI pipelines, or on-demand scans. Combined with live verification, know exactly which leaked keys are still active.
On-prem deployment, SSO/SAML, audit logs, dedicated support. Enterprise tier with zero-trust air-gapped option for regulated industries.
Free forever for developers. No account needed. Just install and scan.
No credit card required • Free tier includes all 74 built-in rules • Upgrade to Pro for live verification