Client-side Secrets & Sensitive Data Exposure Scanner
Find the credentials you leaked โ before someone else does.
Every breach post-mortem has the same paragraph: a credential was exposed in a repo, a log, a paste, a chat. Secrets leak constantly โ in commit diffs, CI logs, .env files, Slack exports, support tickets, even messages to AI assistants. Most people only find out after the crypto-miners do.
Kashif (Arabic: revealer) is a zero-install, zero-telemetry scanner you can hand to any developer, analyst, or auditor. Paste anything. Get an exposure report in seconds. Nothing ever leaves the browser.
| Capability | Detail |
|---|---|
| ๐ 35+ signature patterns | AWS, GitHub, GitLab, Anthropic, OpenAI, Stripe, Slack, Google, Azure, Twilio, SendGrid, npm, PyPI, Hugging Face, Telegram, Shopify, DigitalOcean, JWTs, private key blocks, DB connection strings, and more |
| ๐งฎ Shannon entropy engine | Catches unknown secret formats โ high-entropy strings that look machine-generated |
| ๐ณ Luhn validation | Payment card detection with checksum verification (PCI DSS relevance flagged) |
| ๐ Gulf-region PII | Kuwait & GCC IBAN detection, internal IP disclosure, email PII with GDPR/DPPR context |
| โฆ AI triage (optional) | Bring your own Anthropic API key โ get blast-radius analysis and ordered rotation steps per finding. Only masked values are sent, never the raw secret |
| ๐ Severity scoring | CRITICAL โ INFO with per-finding remediation guidance |
| ๐ Export | One-click Markdown or JSON exposure reports (all values masked) |
| ๐ Multi-file | Drag-and-drop entire config directories, logs, diffs |
| ๐ 100% client-side | Single HTML file. No backend. No analytics. Auditable in one read |
Hosted: https://siteq8.github.io/Kashif/
Local / air-gapped: download index.html, open it. That's it โ works fully offline (fonts degrade gracefully).
git clone https://github.com/SiteQ8/Kashif.git && open Kashif/index.html- Pre-commit sanity check before pushing
- Reviewing a repo you inherited
- Auditing CI/CD logs and pipeline output
- Checking a chat/ticket/paste before sharing it
- Incident response: scoping what a leaked file actually contained
- Security awareness demos โ the built-in DEMO SAMPLE is training-ready
- Revoke first, investigate second. Assume it was copied the moment it was exposed.
- Rotate the credential and audit its usage logs (CloudTrail, GitHub security log, provider dashboards).
- Purge it from git history (
git filter-repo/ BFG) โ deleting the file is not enough. - Fix the root cause: secrets manager + pre-commit hooks + least-privilege scoped tokens with expiry.
Scanning is pure in-browser JavaScript โ zero network calls. The only optional network call is AI triage, which goes directly from your browser to api.anthropic.com using your key, carrying only the secret type, location, and a masked context line. Your key lives in page memory and is never persisted.
New detection rules welcome โ each rule is a single object (regex + severity + remediation). PRs to RULES in index.html.
Built by Ali AlEnezi ยท @SiteQ8 ยท Kuwait ๐ฐ๐ผ
Part of an open-source Gulf-region security tooling suite: Marsad ยท Ghirbal ยท KWTWatch ยท Diwan