semgrep secrets

semgrep --config p/secrets .

Detect secrets with semgrep's registry (p/secrets), scanning the code with community rules for credentials.

Run it in the CI/CD pipeline when you want secret detection with semgrep rules: semgrep with the p/secrets registry analyzes the code and reports findings — API keys, tokens, passwords — with the rule and line. It's the secret detector of the semgrep ecosystem: community rules in the same SAST flow (001). In DevSecOps, semgrep secrets is the pipeline layer: the secret detected with the rules (and your own) in the same code analysis.

Don't use it as complete detection: p/secrets rules cover common patterns — proprietary formats require custom rules (and specialized detectors like gitleaks cover git history). The p/secrets registry requires access (or cache) — in isolated environments, rules are packaged. And watch out: findings are triaged (false positives from patterns); the pipeline blocks on high-severity findings. For git history, gitleaks/trufflehog; semgrep secrets is the code layer.