🛡️ Sentinel

The Rust-powered Secret Scanner | Pre-commit Hook | Zero Leaks

---

⚡ Quick Insights

---

🛠️ The Engine Core Features CI/CD

🚀 Installation cargo install sentinel_cli sentinel init

---

🎯 The Problem

Every day, developers accidentally push secrets to GitHub:

• 🔑 AWS keys → $10,000 bill overnight
• 🗝️ Database passwords → Production breach
• 🎫 API tokens → Unauthorized access

Traditional solutions are slow, bloated, or cloud-dependent.

---

✨ The Solution

Sentinel is a blazing-fast, privacy-first secret scanner written in Rust. It runs locally as a pre-commit hook and blocks commits containing:

✅ AWS Access Keys
✅ OpenAI API Keys
✅ Stripe Secrets
✅ GitHub Tokens
✅ Private Keys
✅ Database Credentials
✅ High-entropy strings (custom secrets)

---

🚀 Quick Start

1️⃣ Install Sentinel

# Via Cargo (Rust package manager)
cargo install sentinel_cli

# Or build from source
git clone https://github.com/meklasdev/sentinel.git
cd sentinel
cargo build --release

2️⃣ Initialize Git Hook

cd your-project
sentinel init

This creates a .git/hooks/pre-commit hook that automatically scans staged files.

3️⃣ Commit with Confidence

git add .
git commit -m "feat: add new feature"

If secrets are detected, the commit is blocked ❌

---

📖 Usage

Manual Scan

# Scan specific files
sentinel scan file1.py file2.js

# Scan with custom entropy threshold
sentinel scan --entropy 5.0 config.yaml

# Fail with exit code 1 if secrets found (for CI/CD)
sentinel scan --fail src/**/*.rs

Pre-commit Hook

# Install hook
sentinel init

# Force overwrite existing hook
sentinel init --force

Scan Staged Files (Manual Pre-commit)

sentinel pre-commit

---

🔍 Detection Methods

1. 100+ Regex Pattern Matching 🎯

Sentinel includes 100+ battle-tested regex patterns organized by category:

☁️ Cloud Providers (11 patterns)

• AWS (Access Keys, Secret Keys, Session Tokens)
• Azure (Storage Keys, Client Secrets)
• Google Cloud (API Keys, OAuth Tokens, Service Accounts)
• DigitalOcean, Heroku, Cloudflare

🤖 AI/ML Providers (6 patterns)

• OpenAI (API Keys, Organization Keys)
• Anthropic (Claude API Keys)
• Hugging Face, Cohere, Replicate

🔧 Version Control & CI/CD (9 patterns)

• GitHub (PAT, OAuth, App Tokens, Refresh Tokens)
• GitLab, Bitbucket
• CircleCI, Travis CI, Jenkins

💳 Payment Processors (5 patterns)

• Stripe (API Keys, Webhook Secrets)
• PayPal, Square, Braintree

💬 Messaging & Communication (8 patterns)

• Slack (Tokens, Webhooks)
• Discord (Bot Tokens, Webhooks)
• Telegram, Twilio, SendGrid, Mailgun

🗄️ Databases (6 patterns)

• MongoDB, PostgreSQL, MySQL, Redis
• Firebase, Supabase (JWT Keys)

📊 Analytics & Monitoring (4 patterns)

• Datadog, New Relic, Sentry, Segment

📱 Social Media & OAuth (3 patterns)

• Facebook, Twitter, LinkedIn

🔐 Crypto & Keys (3 patterns)

• Private Keys (RSA, EC, OpenSSH, DSA, PGP)
• SSH Keys, PGP Keys

🌐 Generic Patterns (6 patterns)

• Generic API Keys, Secrets, Passwords
• JWT Tokens, NPM Tokens, PyPI Tokens, Docker Hub

2. Entropy Analysis 🧮

Detects high-entropy strings (randomness) that likely indicate secrets:

// Example: This would be flagged
let api_key = "aB3$xK9#mP2@qL7!nR5%wT8&yU4*zV1^";

Default threshold: 4.5 bits (configurable via --entropy)

---

🎨 Example Output

⚠ 2 secret(s) detected:

────────────────────────────────────────────────────────────────────────────────
🔍 AWS Access Key ID in src/config.rs
   📍 Line 42
   💡 AWS Access Key ID detected
   🔑 AKIAIOSFODNN7EXAMPLE
────────────────────────────────────────────────────────────────────────────────
🔍 OpenAI API Key in .env
   📍 Line 5
   💡 OpenAI API Key detected
   🔑 sk-proj-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
────────────────────────────────────────────────────────────────────────────────

✗ Commit blocked due to detected secrets!
💡 Remove the secrets and try again.

---

🛡️ Why Sentinel?

Feature	Sentinel	Gitleaks	TruffleHog
Language	🦀 Rust	Go	Python
Speed	⚡ Blazing	Fast	Slow
Privacy	🔒 100% Local	Local	Cloud Option
Entropy Analysis	✅ Built-in	✅	✅
Pre-commit Hook	✅ Auto-install	Manual	Manual
Colored Output	🎨 Beautiful	Basic	Basic

---

🧪 Testing

# Run unit tests
cargo test

# Run with coverage
cargo tarpaulin --out Html

---

🤝 Contributing

Contributions are welcome! See CONTRIBUTING.md for guidelines.

1. Fork the repo
2. Create your feature branch (git checkout -b feature/amazing)
3. Commit your changes (git commit -m 'feat: add amazing feature')
4. Push and open a PR

---

📜 License

MIT © meklasdev

---

🔗 Connect With Me

⭐ Star this repo if you find it useful!

Made with 🦀 Rust by meklasdev