Skip to content
SPECIFICTION
Get listed

Secretlint

github.com

Free plan WindowsmacOSLinuxBrowser extension
Visit github.com
Spec score 7.5 #16 of 24 in Secrets Scanning Software

What it is

Secretlint is a free, MIT-licensed, open-source linting tool for finding credentials in projects and helping prevent commits that contain them. Its command-line interface scans files, glob patterns, or standard input. Detection rules are separate modules, and custom rules can be distributed as npm packages. Secret values are masked in lint error messages by default, reducing exposure in terminal output and logs. Secretlint supports Git workflows, including pre-commit integrations with Husky and lint-staged, pre-commit, and Git hooks. Documentation covers GitHub Actions checks and pull-request annotations through the GitHub formatter. Listed integrations also include Mega-Linter, SARIF formatting, a browser extension, and a macOS clipboard app. The WebExtension works with Chrome and Firefox DevTools to help notice credentials in requests and responses. Installation options include Node.js, Docker, or a single executable without Node.js; the Node.js route requires version 22 or later. It detects secrets but does not automatically fix them.

Spec sheet

Purpose
Secretlint is a pluggable linting tool to find credentials in projects and prevent committing them.Read 9 Oct 2026 · github.com
Support
The README directs users to create a GitHub issue for bugs and feature requests.Read 9 Oct 2026 · github.com
License
The repository states that Secretlint is licensed under MIT.Read 9 Oct 2026 · github.com
Additional integrations
The README lists Mega-Linter, a browser extension, a macOS clipboard app, and SARIF formatter support.Read 9 Oct 2026 · github.com
Browser extension
The WebExtension integrates with Chrome and Firefox DevTools to help web developers notice credentials in requests and responses.Read 9 Oct 2026 · github.com
CI integration
The documentation shows running Secretlint in GitHub Actions and emitting pull request annotations with the GitHub formatter.Read 9 Oct 2026 · github.com
Installation
Secretlint can be installed with Node.js, run in Docker, or used as a single-executable binary that does not require Node.js.Read 9 Oct 2026 · github.com
Notable limitation
Secretlint does not automatically fix detected secrets, although its mask-result formatter can mask secrets in an input file.Read 9 Oct 2026 · github.com
Pre-commit
The project documents pre-commit integrations with Husky and lint-staged, pre-commit, and Git hooks.Read 9 Oct 2026 · github.com
Rules
Rules are separate modules, and users can create custom rules as npm packages.Read 9 Oct 2026 · github.com
Runtime requirement
The Node.js installation instructions require Node.js 22 or later.Read 9 Oct 2026 · github.com
Scanning
The CLI scans files or glob patterns and supports stdin input.Read 9 Oct 2026 · github.com
Secret masking
Secret values are masked in lint error messages by default to help prevent exposure in logs and terminal output.Read 9 Oct 2026 · github.com

Plans and prices

Secretlint Free MIT-licensed project; no paid plans or pricing stated Read 9 Oct 2026 · github.com

Every Secretlint plan and price →

Strong points and limits

Strong points

  • Free MIT-licensed open-source project
  • Scans files, globs, or stdin
  • Masks secret values in errors
  • Supports Git hooks and GitHub Actions
  • Offers custom npm rule modules

Limits

  • Node.js installation requires version 22 or later
  • Does not automatically fix detected secrets

Who it suits

Secretlint suits developers and teams scanning Git projects, pre-commit changes, pull requests, and CI pipelines. It also fits users who need custom npm-based detection rules or browser-based credential checks.

Verdict

Secretlint combines configurable credential detection with Git, CI, pull-request, and browser integrations. Its free license and multiple installation paths suit teams that can handle remediation themselves.

Where Specifiction places it

Alternatives to SecretlintAll alternatives →