Secrets-LE
Find hardcoded credentials in a codebase, and never print one into the report
No editor in the loop? npx -y secrets-le-mcp runs the same engine as an MCP server, so an agent can call detect_secrets with nothing else installed, and cargo install secrets-le puts the same check in a terminal. Every way to install it.
Overview
What Secrets-LE does
The cheapest place to catch a committed credential is before the commit. Secrets-LE scans your workspace for API keys, passwords, tokens and private keys, groups the findings by file with positions pointing at the value, names the issuer of a prefixed key — OpenAI, Anthropic, GitHub, Stripe, Hugging Face and more than twenty others — and can replace them in place with a placeholder. Detection is regex-based over full text, so it works on code, configs, .env files, YAML, JSON and logs alike.
What people use it for
Pre-commit safety net
Scan the workspace and see every detected credential grouped by file, with line and column positions.
Sanitize in place
Replace the secrets in the active file with a placeholder, ready to share or paste into an issue.
Patterns, not proof
A scanner built on patterns can miss secrets and can flag things that are not. Review the results — it is a net, not a guarantee.
Palette
5 commands
Open the command palette and type the name. Nothing is bound to a shortcut by default — the editor's keymap is the user's, not ours.
secrets-le.showPositions: Show the line and column of each secret found. On by default.
- Detect Secrets
secrets-le.detect - Detect Secrets in Folder
secrets-le.detectFolder - Sanitize Secrets
secrets-le.sanitize - Open Settings
secrets-le.openSettings - Help & Troubleshooting
secrets-le.help
Install
Install Secrets-LE
VS Code
ext install nolindnaidoo.secrets-leOpen Quick Open (Cmd/Ctrl+P) and paste.
Cursor / Windsurf
cursor --install-extension nolindnaidoo.secrets-leCursor, Windsurf, VSCodium and the other VS Code forks pull from Open VSX. The id is the same as on the Marketplace.
AI agents
npx -y secrets-le-mcpRuns Secrets-LE's engine as an MCP server, so an agent can call detect_secrets with no editor involved. VS Code 1.101+ needs nothing — the extension registers it for you.
Channels
Where it ships
One engine, 5 places to get it. Copy the one for the editor you use.
Links
Where Secrets-LE lives
- VS Code Marketplacesecrets-le
- Open VSXfor Cursor, Windsurf and VSCodium
- npmsecrets-le-mcp
- GitHubsource, issues, changelog
- MCP registryio.github.nolindnaidoo/secrets-le
The family
The other 16
String-LEExtract every string in a codebase, so a person can read them
Numbers-LEExtract every hardcoded number in a codebase, so a person can check them
Paths-LEExtract every file path in a codebase, and say whether it still points at anything
Colors-LEExtract every color in a codebase, and say which ones are not in your palette
URLs-LEExtract every URL in a codebase, with its protocol and exact position
Dates-LEExtract every date and timestamp, and the exact instant each one resolves to
Units-LEExtract every quantity with its unit, normalized, and refuse the ambiguous ones by name
IDs-LEExtract every UUID, ULID, NanoID, ObjectId and Snowflake, and decode the time inside
IPs-LEExtract every IP address, CIDR block and MAC, normalized and classified by scope
Regex-LEFind every regex in a codebase, and report which can be driven into catastrophic backtracking
Scrape-LECheck whether a page is scrapeable before the scraper is written, and say when it cannot tell
Versions-LEFind where one dependency is constrained differently across a repository's manifests
i18n-LEIdentify the i18n library a project uses, then audit its catalogs by that library's rules
DecisionLintLint Jev and Luna questions before they are sent: the questions you write for TypeSafe's Jev, OpenAI's Decisions API (gpt-6-luna) or any platform that serves one, as you type, with no API key and no network calls. An optional command asks the model itself to check a file
EnvSync-LECompare the dotenv files in a tree, and say which keys are missing from which
Unicode-LEFind the Unicode that hides meaning — bidi controls, invisibles, homoglyphs, mixed scripts