Skip to content

v0.1.0 — Initial public release

Choose a tag to compare

View all tags
@JordanNewell JordanNewell released this 28 Jul 00:37
v0.1.0
66f9524
This commit was signed with the committer’s verified signature.
JordanNewell Jordan Newell
GPG key ID: 6A41229E2CB31940
Verified
Learn about vigilant mode.

PAT Scanner — Claude Code UserPromptSubmit hook that blocks credential leaks at chat-time.

What it does

Catches 13 credential classes (Figma, Anthropic, OpenAI, GitHub, Slack, Stripe, PyPI, Z.ai, JWT, Natural, AWS) BEFORE they enter the chat transcript. Companion defense to gitleaks/trufflehog — those catch leaks at git time. PAT Scanner catches them at chat time, the actual point of leak.

Install

/plugin marketplace add JordanNewell/pat-scanner
/plugin install pat-scanner

Restart Claude Code. Verify with /help → look for UserPromptSubmit hook.

At-a-glance
Version 0.1.0
License MIT
Tests 18/18 passing
Patterns 13 credential classes out of the box
Bypass keyword BYPASS_SECRET_SCAN (for legitimate debug)
Audit log ~/.pat-scanner/audit.log (blocks only)
User override ~/.config/secret-patterns.local survives plugin updates

Highlights

  • POSIX ERE only — grep -E, no PCRE dependency. Two silent-failure traps documented in CONTRIBUTING.md (no (?:...) non-capturing groups; [[:space:]] cannot appear inside bracket expressions).
  • Fail-open — if patterns file is missing or unreadable, scanner exits 0 with stderr warning. Doesn't block all of Claude Code.
  • Programmatic test fixtures — constructed from clearly-fake parts (repeat 'FAKE' 13) so the static file contains no real-shaped tokens. Allows the repo to push through GitHub secret scanning without .gitleaksignore brittleness.

Install path resolution (first hit wins)

  1. $PAT_SCANNER_PATTERNS (explicit env override)
  2. ~/.config/secret-patterns.local (user customization, survives plugin updates)
  3. ${CLAUDE_PLUGIN_ROOT}/patterns/secret-patterns.local (bundled defaults)

Customize

mkdir -p ~/.config
cp ~/pat-scanner/patterns/secret-patterns.local ~/.config/
$EDITOR ~/.config/secret-patterns.local

Verify install

Paste this in a Claude Code session:

figd_DEADBEEFFAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKE

Expected: blocked with stderr BLOCKED: prompt contains secret-shaped string matching: Figma PAT.

Roadmap

  • v0.2 — Hosted Team Center (centralized audit dashboard, Slack/Teams alerting, SOC2 export). Separate product, OSS plugin stays free.
  • v0.3 — Additional patterns (GitLab PAT, Bitbucket app password, Linear API key, Datadog, Sentry auth token). Contributions welcome.
  • v0.4 — Multi-line paste detection (current scanner is line-oriented).

Sources

Built on detection patterns from gitleaks and TruffleHog. Field name contract verified against Claude Code hooks docs.

Author

Jordan Newell — https://jordannewell.com

Assets 2
Loading