Scan text (a git diff, a file's contents, a pasted snippet) for accidentally-committed secrets: cloud provider keys (AWS, Google), platform tokens (GitHub, Slack, npm), payment keys (Stripe), private key blocks, JWTs, and a generic entropy-gated check for anything assigned to a secret-sounding variable name. Use this before committing, opening a PR, or pasting logs/config anywhere -- a committed secret is one of the most common real-world causes of account and infrastructure compromise, and is easy to miss in a large diff.

Findings are always redacted (first/last few characters only) -- this tool never returns a full secret value, so its own output is safe to log or display.

Args:

• text (string, 1-200000 chars): the text to scan.

Returns: For JSON format: { "found": boolean, "riskLevel": "none" | "medium" | "high" | "critical", "findings": [ { "detector": string, "category": string, "severity": "low"|"medium"|"high"|"critical", "line": number, "column": number, "redacted": string } ] }

Examples:

• Use when: about to run "git commit" or "git push" -- scan the staged diff first

• Use when: about to paste a config file, log excerpt, or error message into a chat or issue tracker

• Don't use when: you need certainty nothing sensitive is present -- this is a fixed-pattern + heuristic scan, not exhaustive; a clean result means "no known pattern matched," not "definitely safe"

Error Handling:

• Returns an error if text is empty or exceeds 200000 characters.