Secrets-LE

Name: Secrets-LE
Author: nolindnaidoo

Detect and sanitize credentials, tokens, API keys, and private keys locally — before you commit.

FreeOpen sourceMITNo network access

Install for VS Code Source on GitHub

Secrets-LE in use: Detect and sanitize credentials, tokens, API keys, and private keys locally — before you commit.

What Secrets-LE does

The cheapest place to catch a committed credential is before the commit. Secrets-LE scans your workspace for API keys, passwords, tokens and private keys, groups the findings by file with positions pointing at the value, and can replace them in place with a placeholder. Detection is regex-based over full text, so it works on code, configs, .env files, YAML, JSON and logs alike.

What people use it for

Scan the workspace and see every detected credential grouped by file, with line and column positions.

Replace the secrets in the active file with a placeholder, ready to share or paste into an issue.

A scanner built on patterns can miss secrets and can flag things that are not. Review the results — it is a net, not a guarantee.

Install Secrets-LE

VS Code

ext install nolindnaidoo.secrets-le

Open Quick Open (Cmd/Ctrl+P) and paste.

Cursor / VSCodium

cursor --install-extension OffensiveEdge.secrets-le

VS Code forks pull from Open VSX, where the namespace is OffensiveEdge.

ZedComing soon

npx -y secrets-le-mcp

Works in Zed today — add the command above as a custom MCP server from the agent panel, and detect_secrets appears in its tool list. The one-click listing in Zed's extension registry is a pull request awaiting review. Track the review.

AI agents

npx -y secrets-le-mcp

Runs Secrets-LE's engine as an MCP server, so an agent can call detect_secrets with no editor involved. VS Code 1.101+ needs nothing — the extension registers it for you.