Secret Exposure Path

Local-first credential tracing

Trace where secrets travel. Before they leave.

Wrap a build, agent, or release command. See the redacted path from a local source into logs, Git diffs, and generated artifacts—without sending the value anywhere.

cargo install --git …/sf-secret-exposure-path
Trace a sample Read the CLI guide

Open sourceNo telemetryOne binary

An amber source prism sends a luminous path through a violet command prism to three artifact sinks; one path turns coral to mark exposure.
SOURCECOMMAND3 SINKS · 1 EXPOSED

Values stay in memory. Reports keep only a 12-character fingerprint and location.

Network not required

01 / Path model

One command. Every declared exit.

`sep` reads only the sources and outputs you name, plus staged and unstaged Git diffs. It maps exact matches and high-confidence credential shapes.

  1. A

    Declare sources

    Dotenv files and selected environment variables become in-memory candidates.

    --source .env
  2. B

    Wrap the command

    Output is captured, scanned, redacted, and then forwarded to your terminal.

    -- npm run build
  3. C

    Trace each sink

    Findings link source → command → log, artifact, working tree, or staged diff.

    exit 10

02 / Browser lab

Run a trace without uploading a byte.

This small browser model uses the same declared-value idea as the CLI. Change either side to test exposed, clear, and error states.

Runs locally—even offline

TRACE BENCH / 0.1READY
Nothing entered here is saved.

Edit the sample or run the ready trace.

03 / Use it

A narrow interface for local and CI work.

shellsource → command → artifact + git
# Build and install the single Rust binary
cargo install --git https://github.com/B-Divyesh/sf-secret-exposure-path

# Wrap a command and declare the outputs to inspect
sep run \
  --source .env \
  --from-env DEPLOY_TOKEN \
  --output dist/build.log \
  -- npm run build

# CI: one JSON report; exit 10 blocks an exposure
sep run --json --source .env.ci -- ./ci.sh
00

Clear

No source value or high-confidence shape reached a scanned sink.

10

Exposure found

Use the stable exit code to stop CI before publishing or committing.

02

Could not scan

A source is missing, unreadable, or the command could not start.

Honest boundary

A path map, not a vault.

Exact tracking stops when a value is encrypted, split, or transformed beyond recognition. Shape-only findings are labeled unattributed. Narrow fingerprint and path allowlists tame known fixtures without hiding every result.

Read the detection limits