Secret Detector

Overview

You pass text, code, or config; we scan it with a curated, deterministic, ReDoS-safe rule pack (PEM keys, AWS access-key IDs, GitHub/Slack tokens, JWTs, bearer tokens, basic-auth URLs, generic credential assignments) plus optional Shannon-entropy checks in strict mode. This is preflight risk reduction — not Gitleaks/TruffleHog parity. We never return the full secret, only a redacted preview. Do not treat a clean result as proof the text is secret-free.

Secrets leak into code, config, and agent output all the time — you need a deterministic preflight before publishing, committing, or transmitting content.

When to use it

Scope

Non-goals

• Does not guarantee complete secret removal (best-effort)
• Does not call external scanners or networks
• Does not return full secret values
• Not Gitleaks/TruffleHog parity — a curated 8-detector pack, not hundreds of provider rules
• Does not verify whether a matched value is a live/active credential
• Does not tune the rule pack to contentKind — the same detectors run for every kind
• Known false-negative classes: unlisted providers (GCP/Azure/Stripe/Twilio/…), obfuscated/base64-wrapped or line-split secrets, and low-entropy custom tokens

Properties

Capabilities

Cost & billing

Flat rate per invocation

File handling

How we handle your data

Input schema

Output schema

API contract

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"security.detect_secrets","input":{"text":"aws_key = AKIAIOSFODNN7EXAMPLE"}}'

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("security.detect_secrets", {"text":"aws_key = AKIAIOSFODNN7EXAMPLE"});

Errors

Other limits

Limitations

• Does not guarantee complete secret removal (best-effort)
• Does not call external scanners or networks
• Does not return full secret values
• Not Gitleaks/TruffleHog parity — a curated 8-detector pack, not hundreds of provider rules
• Does not verify whether a matched value is a live/active credential
• Does not tune the rule pack to contentKind — the same detectors run for every kind
• Known false-negative classes: unlisted providers (GCP/Azure/Stripe/Twilio/…), obfuscated/base64-wrapped or line-split secrets, and low-entropy custom tokens
• Guaranteed compliance-grade DLP (this is best-effort)
• Detecting semantic PII like names/addresses (use text.mask_pii)
• Validating that a specific known secret is present

How to call

POST /v1/execute (requires authentication)

{
  "skillKey": "security.detect_secrets",
  "input": {
    "text": "aws_key = AKIAIOSFODNN7EXAMPLE"
  }
}

Examples

{
  "text": "aws_key = AKIAIOSFODNN7EXAMPLE"
}

{
  "findingCount": 1,
  "truncated": false,
  "hasSecrets": true,
  "findings": [
    {
      "confidence": 0.9,
      "kind": "aws_access_key_id",
      "column": 11,
      "detector": "aws_access_key_id",
      "startChar": 10,
      "line": 1,
      "redactedPreview": "AKIA…MPLE",
      "endChar": 30,
      "recommendation": "Rotate the AWS credential and remove it from source."
    }
  ]
}

{
  "text": "The quick brown fox."
}

{
  "findingCount": 0,
  "truncated": false,
  "hasSecrets": false,
  "findings": []
}

Recommended use cases

• Preflight content before committing, publishing, or transmitting
• Flag leaked credentials in agent-generated output
• Gate documents before summarization or sharing

Avoid for

• Guaranteed compliance-grade DLP (this is best-effort)
• Detecting semantic PII like names/addresses (use text.mask_pii)
• Validating that a specific known secret is present

Related skills

Composable with

Safety & privacy

• Runs without calling any external service.
• Your payloads are never stored permanently.
• Telemetry captures metadata only — never your payload contents.
• We never train models on your payloads.
• No human reviews your payloads.

Tags