reDACT

reDACT is a command-line tool that scans git repositories for leaked secrets — API keys, tokens, private keys, JWTs, connection strings, and similar patterns. It walks full git history, so that secrets that were committed and then later deleted are still found. Only scan repositories that you own or have explicit permission to audit.

Source: github.com/dsdugal/redact

The package is not published on PyPI yet. See Installation for how to get started.

Features

• Scan a local repo, a remote URL, or every public repo for a GitHub user (non-fork, non-archived only)
• Regex catalog for major providers (AWS, GCP, GitHub, Slack, Stripe, Twilio, SendGrid, npm, PyPI, ...) plus generic password / private-key / JWT / DB-URL detectors
• Full-history scan with per-blob deduplication
• Categorized findings: provider, type, severity
• Allowlist file and inline # redact: allow pragma (case-insensitive, e.g. # reDACT: allow)
• Masked values in the report
• Parallel multi-repo scanning (up to 8 workers, capped by CPU count)
• Rendered to stdout via rich; pipes cleanly to a file

Requirements

• Python 3.10+ (see requires-python in pyproject.toml)
• git on your PATH (used for local repos and for cloning remote URLs)

Installation

git clone https://github.com/<your-org>/redact.git   # adjust to your fork or mirror
cd redact

python3 -m venv .venv                                # optional but recommended
source .venv/bin/activate                            # Windows: .venv\Scripts\activate

pip install -e .

Use

redact .                                  # current repo
redact https://github.com/owner/repo.git  # remote (clones to tmp)
redact --github-user someone              # public repos (excludes forks & archived)

redact . --allowlist .redact.yml          # suppress known patterns

redact . > findings.txt                   # rich strips ANSI when piped

GitHub auth

For higher rate limits (and to enumerate larger profiles) set:

export GITHUB_TOKEN=ghp_xxx

The token is only used as an API auth header and is never logged.

Allowlist file (.redact.yml)

Allowlists let you suppress known-safe matches without rewriting rules. reDACT uses --allowlist <path> if given, else auto-discovers .redact.yml in the current directory or, when scanning a single local target, in that repo's root. The file is YAML with three optional keys:

• rules — list of rule ids to disable globally
• paths — POSIX globs (** supported); findings under any matching path are dropped
• values — Python regexes; matches against the raw secret value are dropped

rules:
  - id: generic-password           # disable a rule globally
paths:
  - "tests/fixtures/**"            # ignore findings under these globs
values:
  - "EXAMPLEFAKE.*"                # regex of values to ignore

Inline pragma

Use inline pragmas when one specific occurrence is intentional and the surrounding rule should still apply elsewhere. Append # redact: allow (or // redact: allow) to a line to suppress findings on that line. Matching is case-insensitive (# reDACT: allow works).

Exit codes

reDACT always returns 0 after a successful scan, regardless of whether findings were reported — so you can pipe output to a file or other tools without scripts treating findings as failures.

Code	Meaning
0	Scan completed
2	Usage / runtime error

Changelog

See CHANGELOG.md.

License

This project is distributed under the MIT License.