Documentation

Install, scan, configure, and integrate Credfence

Installation

One command installs the free Credfence CLI — prebuilt binary with the 74 detection rules built in. No compiler, no repository access, no account.

macOS & Linux

curl -fsSL https://credfence.com/install.sh | sh

Windows (PowerShell)

irm https://credfence.com/install.ps1 | iex

Docker (optional)

docker run --rm -v "$PWD:/repo" ghcr.io/credfence/credfence scan /repo

Installs to /usr/local/bin (or ~/.local/bin) on macOS/Linux and %LOCALAPPDATA%\Credfence\bin on Windows. Downloads are checksum-verified; remove with --uninstall.

Editions (Free & Pro)

Credfence builds as two editions from one codebase. The Free build ships no licensing code; the Pro build adds deep history scans, live verification, the SaaS worker, and Licenta licensing.

Free edition (default)

curl -fsSL https://credfence.com/install.sh | sh

Pro edition (licensed)

Included with a Pro license — sign in to download the licensed build from your dashboard.

Capability	Free	Pro
Head scans, 74 built-in rules, 5 output formats	✓	✓
CI/CD: Docker, GitHub Action, pre-commit	✓	✓
Deep history + diff scans (`--deep`, `--diff-only`)	—	✓
Live verification (`--verify`)	—	✓
SaaS worker + team dashboard	—	✓
Licensing code (`setup` / `license`)	none	Licenta

The Free binary does not expose --deep, --diff-only, --verify, or the worker / setup / license subcommands.

Usage & Scan Modes

Head scan (working tree) — default

Fastest mode. Scans files currently in your working tree.

credfence scan ./my-repo --format console

Deep scan (full Git history) (Pro)

Walks every blob in every commit. Finds secrets even if deleted long ago. Requires a Pro license.

credfence scan ./my-repo --deep --format sarif

Diff-only scan (incremental) (Pro)

Scans only changed lines per commit. Faster. Pro: add date filters (--since, --max-commits).

credfence scan ./my-repo --deep --diff-only
credfence scan ./my-repo --deep --since 2024-01-01

Verify live secrets (Pro)

Check if found keys are still active via provider APIs.

credfence scan . --verify
# github-pat: VERIFIED (still active!)

Scan stdin or directories

Pipe text or scan a directory without git.

echo "TOKEN=ghp_xxx" | credfence scan - --stdin
credfence scan ./dir --no-git

CLI Reference

credfence scan <REPO> [options]

  --commit <SHA>       Commit to scan [default: HEAD]
  --token <TOKEN>      Auth token for private repos
  -r, --rules <PATH>         Use ONLY these rules (replaces the 74 built-ins)
      --rules-extra <PATH>   Extra rules merged with the built-ins (repeatable)
  --deep               Scan full Git history [Pro]
  --diff-only          Scan only changed lines (with --deep) [Pro]
  --since <DATE>       Pro: only commits after date
  --max-commits <N>    Pro: limit commit count
  --threads <N>        Threads for parallel scan
  --no-parallel        Disable parallelism
  --ignore <GLOB>      Ignore pattern (repeatable)
  --format <FMT>       console|json|sarif|csv|junit [default: console]
  --output <FILE>      Write report to file
  --verify             Pro: live secret verification
  --notify-slack <URL> Pro: Slack alert
  --notify-email <ADDR> Pro: email alert
  --baseline <FILE>    Suppress known findings
  --summary            Severity summary only
  --stdin              Read from pipe
  --no-git             Scan dir without git

credfence list-rules [--rules-extra <PATH>]
credfence setup                One-time license setup
credfence license <CMD>       activate | validate | deactivate | status | verify
credfence worker               Poll the SaaS dashboard queue
credfence --version

Output Formats

--format console

Colorized human-readable with severity icons

--format json

Line-delimited JSON + summary

--format sarif

SARIF 2.1.0 for GitHub Code Scanning, VS Code, GitLab

--format csv

Spreadsheet-friendly, escaped fields

--format junit

JUnit XML for Jenkins, Azure DevOps

Configuration

Create .credfence.toml in your repo root:

# .credfence.toml
rules_extra = ["./my-rules"]   # merged with the 74 built-ins
# rules = "./my-rules"         # replace the built-ins instead
format = "sarif"
ignore = ["node_modules/**", "vendor/**"]
baseline = ".credfence-baseline"

Your rules (YAML)

The 74 built-in rules are embedded in the binary - credfence list-rules lists them. Add your own with --rules-extra <PATH> (merged) or --rules <PATH> (replace the set). Reusing a built-in id overrides that rule.

# ./my-rules/internal.yaml
- id: internal-jwt-secret
  name: Internal JWT Signing Key
  severity: critical
  secret_group: custom
  pattern: 'MYCOMP_[A-Za-z0-9+/=]{32,}'
  keywords: [MYCOMP_, jwt_secret, SIGNING_KEY]
  entropy_min: 4.5
  allowlist:
    values: [mycomp-example-key-0000]
  enabled: true

CI/CD Integration

GitHub Actions

- name: Install Credfence
  run: curl -fsSL https://credfence.com/install.sh | sh

- name: Secret scan
  run: credfence scan . --format sarif --output credfence.sarif

GitLab CI

secret_scan:
  image: ghcr.io/credfence/credfence:latest
  script:
    - credfence scan . --format sarif --output credfence.sarif
  artifacts:
    reports:
      sast: credfence.sarif

Pre-commit hook

repos:
  - repo: local
    hooks:
      - id: credfence
        name: Credfence secret scan
        entry: credfence scan .
        language: system
        pass_filenames: false

Exit Codes

No leaks found

Secrets found, blocks CI

Error / Pro feature needed

Licensing & Plans

Credfence is free for head scans. Deep history scans, live verification, and the team dashboard require a Pro license, issued and verified through Licenta (licenta.mkswebs.com).

One-time setup

Interactive wizard that saves your API key and license key to ~/.config/credfence/config.toml.

credfence setup

Activate & check status

credfence license activate PROD-XXXX-XXXX-XXXX-XXXX
credfence license status
credfence license verify <TOKEN>

Configuration

Licenta settings live in the [license] table of .credfence.toml, or as environment variables: CREDFENCE_LICENTA_BASE_URL, CREDFENCE_LICENTA_API_KEY, CREDFENCE_LICENTA_PUBLIC_KEY.

Free vs Pro

Free — forever

✓74 built-in rules, 17 categories
✓Unlimited head scans
✓CI/CD: Docker, GitHub Action, pre-commit
✓5 output formats
✓Baseline, .gitignore, archive scan

Pro — $12/dev/mo

✓Deep history + diff scans
✓Live secret verification
✓Slack + Email alerts
✓Incremental scans (--since, --max-commits)
✓Team dashboard (findings, scan history, API keys)

Compare plans