v1.0.1

Fixed

• Fixed --staged scanning to inspect Git index blob contents rather than working-tree contents.
• Added regression coverage for partially staged files and other staged-index edge cases.

See CHANGELOG.md for details.

V1.0

SecretSieve v1.0.0 is the first production-ready release of the local-first secret detection CLI.

It scans source code, configuration files, and project directories for exposed credentials using a multi-signal detection engine that combines 24 detection rules, entropy analysis, token context, validation, false-positive reduction, and deterministic confidence and severity scoring.

The release includes:

• 24 built-in detection rules covering major API keys, tokens, cloud credentials, JWTs, private keys, database URLs, webhooks, environment variables, and more.
• Shannon entropy analysis with rule-specific profiles.
• Context-aware detection and ordered false-positive suppression.
• Deterministic confidence scores, severity levels, and stable finding fingerprints.
• Redacted human-readable, quiet, verbose, and JSON output.
• Git working-tree, staged, and unstaged scanning.
• Configurable rules, allowlists, path exclusions, and custom scanning behavior.
• --fail-on CI-friendly exit codes without requiring network access.
• JSON Schema v1 reporting for machine-readable integrations.
• Symlink loop protection, binary detection, file-size limits, and per-file scan budgets.
• A comprehensive test suite covering detection, CLI behavior, determinism, privacy, redaction, ReDoS resistance, configuration abuse, and filesystem edge cases.
• Zero runtime dependencies and support for Python 3.10+.

SecretSieve is designed to keep scanning private and local: it performs no network requests, uses no telemetry, and never sends detected secrets to third-party services.

This release establishes the core scanning engine, CLI, configuration system, reporting format, and security foundations for future development.