seal-commit
Advanced tools
A production-ready CLI tool to automatically detect and block API keys, secrets, tokens, or credentials from being committed to Git repositories
A production-ready CLI tool to automatically detect and block API keys, secrets, tokens, or credentials from being committed to Git repositories.
Install as a dev dependency in your project:
npm install --save-dev seal-commit
Or use with npx (no installation required):
npx seal-commit
When installed via npm, seal-commit automatically:
git commit# Check staged files (default behavior)
npx seal-commit
# Scan all tracked files in repository
npx seal-commit scan-all
# Attempt to redact/fix detected secrets
npx seal-commit fix
# Generate JSON report
npx seal-commit --report secrets-report.json
check (default)Scans staged files for secrets before commit:
npx seal-commit check
# or simply
npx seal-commit
Options:
-c, --config <path> - Use custom configuration file--no-colors - Disable colored output-v, --verbose - Enable verbose output with additional details-r, --report <path> - Generate JSON report at specified pathscan-allScans all tracked files in the repository:
npx seal-commit scan-all
Options:
-c, --config <path> - Use custom configuration file--no-colors - Disable colored output-v, --verbose - Enable verbose output-r, --report <path> - Generate JSON reportfixAttempts to redact or remove detected secrets:
npx seal-commit fix
Options:
-c, --config <path> - Use custom configuration file--no-colors - Disable colored output-v, --verbose - Enable verbose output--backup - Create backup files before making changes (default: true)Create a .sealcommitrc file in your project root to customize behavior:
{
"patterns": {
"custom": [
"my-custom-secret-pattern-\\w{32}"
],
"enabled": [
"aws-access-key",
"google-api-key",
"jwt-token"
],
"disabled": [
"bearer-token"
]
},
"entropy": {
"threshold": 4.5,
"minLength": 25,
"maxLength": 80
},
"ignore": {
"files": [
"*.test.js",
"mock-data.json"
],
"directories": [
"test-fixtures",
"examples"
],
"extensions": [
".example",
".template"
]
},
"allowlist": [
"example-api-key-not-real",
"test-token-12345"
]
}
Configuration files can be in JSON or YAML format:
.sealcommitrc.sealcommitrc.json.sealcommitrc.yaml.sealcommitrc.ymlseal-commit detects these secret types out of the box:
Cloud Provider Keys:
AKIA[0-9A-Z]{16})[0-9a-zA-Z/+]{40})AIza[0-9A-Za-z\\-_]{35})Service API Keys:
sk_live_, pk_live_)ghp_, gho_, ghs_, ghr_)Generic Patterns:
eyJ...)Bearer [token])-----BEGIN PRIVATE KEY-----)Detects high-entropy strings that might be secrets:
When secrets are detected:
❌ Secrets detected in staged files!
📁 src/config.js
Line 15: AWS Access Key
AKIA████████████████ (truncated)
Line 23: High-Entropy String
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9... (truncated)
📁 api/auth.js
Line 8: Google API Key
AIza████████████████████████████████ (truncated)
🚫 Commit blocked! Found 3 secret(s) in 2 file(s).
To bypass this check (NOT RECOMMENDED):
git commit --no-verify
Generate structured reports for CI/CD:
npx seal-commit --report secrets-report.json
{
"summary": {
"hasSecrets": true,
"totalFindings": 3,
"filesScanned": 15,
"filesWithSecrets": 2,
"scanDuration": 245
},
"findings": [
{
"type": "pattern",
"category": "aws-access-key",
"filePath": "src/config.js",
"lineNumber": 15,
"columnStart": 20,
"columnEnd": 40,
"truncatedMatch": "AKIA████████████████",
"confidence": 0.95
}
],
"metadata": {
"scanMode": "staged-files",
"timestamp": "2024-01-15T10:30:00.000Z",
"version": "1.0.0"
}
}
Add your own regex patterns to detect organization-specific secrets:
{
"patterns": {
"custom": [
"MYCOMPANY_API_[A-Z0-9]{32}",
"internal-token-[a-f0-9]{64}"
]
}
}
Exclude files, directories, or patterns from scanning:
{
"ignore": {
"files": [
"*.min.js",
"test-data.json",
"mock-*.js"
],
"directories": [
"node_modules",
"dist",
"test-fixtures"
],
"extensions": [
".log",
".tmp",
".cache"
]
}
}
Whitelist known safe strings that shouldn't be flagged:
{
"allowlist": [
"example-api-key-12345",
"test-secret-not-real",
"demo-token-for-docs"
]
}
Adjust entropy detection sensitivity:
{
"entropy": {
"threshold": 4.5, // Higher = less sensitive
"minLength": 30, // Minimum string length to check
"maxLength": 200 // Maximum string length to check
}
}
name: Security Scan
on: [push, pull_request]
jobs:
scan-secrets:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: actions/setup-node@v3
with:
node-version: '18'
- run: npm install
- run: npx seal-commit scan-all --report secrets-report.json
- uses: actions/upload-artifact@v3
if: failure()
with:
name: secrets-report
path: secrets-report.json
If you need to manually configure the pre-commit hook:
#!/bin/sh
# .husky/pre-commit
npx seal-commit
{
"scripts": {
"security:scan": "npx seal-commit scan-all",
"security:fix": "npx seal-commit fix",
"security:report": "npx seal-commit scan-all --report security-report.json"
}
}
Problem: Running seal-commit outside a Git repository. Solution: Initialize Git or run from within a Git repository:
git init
Problem: No files are staged for commit.
Solution: Stage files first or use scan-all mode:
git add .
# or
npx seal-commit scan-all
Problem: Insufficient permissions to install Husky hooks. Solution: Check repository permissions or run with appropriate privileges.
Problem: Too many legitimate strings flagged as secrets. Solution: Adjust entropy threshold or add to allowlist:
{
"entropy": {
"threshold": 4.5
},
"allowlist": [
"legitimate-string-that-looks-like-secret"
]
}
Problem: Known secrets not being detected. Solution:
Enable verbose output for troubleshooting:
npx seal-commit --verbose
In emergency situations, you can bypass the pre-commit hook:
git commit --no-verify
⚠️ Warning: This bypasses all secret detection. Use only when absolutely necessary.
If migrating from other tools:
npm install --save-dev seal-commit.sealcommitrcnpx seal-commit scan-all to verifyWhen updating from older versions:
{
"patterns": {
"custom": ["string[]"],
"enabled": ["aws-access-key", "aws-secret-key", "google-api-key", "stripe-key", "github-token", "firebase-key", "jwt-token", "bearer-token", "private-key"],
"disabled": ["string[]"]
},
"entropy": {
"threshold": 4.0,
"minLength": 20,
"maxLength": 100
},
"ignore": {
"files": ["*.min.js", "*.map", "package-lock.json", "yarn.lock", "pnpm-lock.yaml"],
"directories": ["node_modules", ".git", "dist", "build", "coverage"],
"extensions": [".min.js", ".lock", ".map", ".log"]
},
"allowlist": ["string[]"],
"output": {
"format": "terminal|json|both",
"colors": true,
"verbose": false
}
}
NO_COLOR - Disable colored output (respects standard)CI - Automatically detected for CI/CD environmentsWe welcome contributions! Please see our Contributing Guide for details.
git clone https://github.com/your-org/seal-commit.git
cd seal-commit
npm install
npm test
# Run all tests
npm test
# Run with coverage
npm run test:coverage
# Run in watch mode
npm run test:watch
This project is licensed under the MIT License - see the LICENSE file for details.
Made with ❤️ for secure development workflows
[1.0.0] - 2025-01-28
npm install--scan-all to scan entire codebase--fix to automatically redact detected secrets--report to generate JSON reports for CI/CD integration--config to specify custom configuration file.sealcommitrc files in JSON and YAML formats--no-verify and clear warningsseal-commitnpm install --save-dev seal-commitnpx seal-commit or automatic via Git hooksFAQs
A production-ready CLI tool to automatically detect and block API keys, secrets, tokens, or credentials from being committed to Git repositories
The npm package seal-commit receives a total of 9 weekly downloads. As such, seal-commit popularity was classified as not popular.
We found that seal-commit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
npm now supports Trusted Publishing with OIDC, enabling secure package publishing directly from CI/CD workflows without relying on long-lived tokens.
Research
/Security News
A RubyGems malware campaign used 60 malicious packages posing as automation tools to steal credentials from social media and marketing tool users.
Security News
The CNA Scorecard ranks CVE issuers by data completeness, revealing major gaps in patch info and software identifiers across thousands of vulnerabilities.