Scan a Git repository for privacy and security risks before publishing it.
git-privacy-scanner checks both the current working tree and Git history so a deleted secret does not remain silently recoverable from an old commit. Findings are fingerprinted instead of echoed back, which keeps scan logs from becoming a second leak.
- Common API keys, bearer tokens, private-key blocks and secret assignments
- Personal email addresses in files and commit metadata
- Phone-number-shaped PII
- macOS user-directory paths
- Private RFC1918 IP addresses
- Risky files such as environment files, database dumps, private keys and logs
- Sensitive strings embedded inside binary metadata
- Secrets or PII that were committed and later deleted
- History scans that exceed the configured safety limit
GitHub noreply addresses and documentation-only example domains are allowed.
Run: python3 -m pip install .
Direct use: PYTHONPATH=src python3 -m git_privacy_scanner.cli /path/to/repo
For CI, add --json and treat exit code 1 as a publishing blocker.
The JSON report contains rule names, severity, locations and SHA-256 fingerprints. It intentionally does not print the raw matched secret or PII value.
This tool is a strong release gate, not a proof that a repository contains no sensitive information. Review final staged files manually and use synthetic data for demos. Fresh public history is preferable when a private production repository has years of mixed operational data.