Loading Abhiram Reddy Palle

Abhi/ 26
Your time on this site
→All workCase study 02 / 04

Developer tool · Security

Secret Leak Detector

Catches the key before it's in your git history.

Type
Developer tool · Security
Role
[Add role]
Year
2026
Status
Prototype

(01)The problem

Once a secret is committed and pushed, deleting the file doesn't fix anything — it lives on in the history, in forks and in every clone. Most leaks aren't malicious. They're a config file added by accident, at the end of a long day, by someone who knows better.

(02)The idea

Stop leaks at the earliest possible moment — while the key is still being typed — and again at every boundary after that: the commit, then the pull request. Keep the findings somewhere reviewable, and make sure the tool itself can never become the leak.

(03)The build

Detection goes beyond brittle regex: vendor patterns, Shannon-entropy thresholds and syntactic and file-context signals decide what counts as a credential. The same engine runs in the editor, in the hook and at the GitHub boundary.

A VS Code extension debounces keystrokes (~400 ms) and underlines a secret before it's even saved. A zero-dependency pre-commit hook fails closed and blocks the commit. A GitHub App scans pull-request diffs in memory and posts a check run with redacted annotations — with a local simulator as a guaranteed fallback for demos on bad venue Wi-Fi.

Every finding crosses a privacy boundary: the candidate is fingerprinted with keyed HMAC-SHA256 and the raw value is discarded. That same fingerprint spots one credential reused across several repositories without anyone ever holding the secret — and the dashboard explains each finding's blast radius: payments, cloud, source control, data.

Three checkpoints, one engine
  1. 01→TypeRed squiggle in the editor
  2. 02→CommitPre-commit hook blocks it
  3. 03→Pull requestGitHub check fails the merge
  4. 04→FingerprintHMAC — raw secret discarded
  5. 05■ReviewBlast radius on the dashboard
Runtime
Node.js
Checkpoints
VS Code extension/Git pre-commit hook/GitHub App/Checks API
Detection
Vendor patterns/Shannon entropy/Context signals
Privacy & tests
HMAC-SHA256/node:test

(04)The hard part

  1. 01

    Noise vs. misses

    Too strict and people learn to skip the hook. Too loose and it's decoration. Patterns alone miss things; entropy alone cries wolf. The engine combines them with context to find the balance.

  2. 02

    Never become the leak

    A secret scanner handles exactly the data it's meant to protect. Raw values never touch disk, logs or the UI — the store refuses keys named like secrets, and the interface only ever shows truncated fingerprints.

  3. 03

    It has to feel instant

    A check that runs on every keystroke and every commit gets bypassed the moment it's slow. Debounced in the editor, zero dependencies in the hook.

  4. 04

    A demo that can't fail

    Hackathon networks are hostile. The simulator replays pull-request checks locally with the exact same engine and check-run builder as the real GitHub App.

(05)The result

A working secret firewall: live editor diagnostics, a commit hook that fails closed, pull-request checks through a real GitHub App (plus an offline simulator), cross-repo correlation by fingerprint, and a compliance dashboard — with a Node test suite behind it.

[ADD — what it has caught, and where it's used]

Live[Add link]CodeView the code ↗Video[Add link]

(06)What's next

First versions are rarely the final versions. This one won't be either.

[Add what you'd improve next]

(07)Under the hood

Pre-commitIllustrative output

~/project $ git commit -m "update config"

▸ leak-detector · scanning 3 staged files

✓ src/app/page.tsx

✓ README.md

✕ config/settings.ts:14possible API key

✕ commit blocked — 1 finding

review it in the dashboard, rotate the key, try again.

~/project $

Stage
Scan
Block

The same picture the film runs — an illustration of how Secret Leak Detector thinks, not a screenshot.

(08)Screens

A blocked commitScreen 01
Dashboard overviewScreen 02
A finding, redactedScreen 03
Next — 03 / 18Research · Remote sensingCERTUS-S2→When can you trust a pixel a model made up?