{"slug": "i-built-a-secret-scanner-that-tries-to-answer-is-this-secret-actually-live", "title": "I built a secret scanner that tries to answer “is this secret actually live?\"", "summary": "A developer has built SecretLoop, a secret scanner now in Preview on Open VSX that goes beyond detection to verify whether exposed credentials are still live and guide remediation. The tool integrates with MCP for AI-assisted workflows, redacts credential values, and requires explicit human approval before any verification request is sent to a provider.", "body_md": "I’ve been building **SecretLoop**, and it’s now available in Preview on Open VSX.\n\nThe problem I was trying to solve is pretty simple.\n\nYou run a secret scanner and get:\n\n“Found an API key.”\n\nCool. But then what?\n\nIs it still active?\n\nWas it already revoked?\n\nIs it buried somewhere in Git history?\n\nDo I need to rotate it?\n\nAnd how do I actually remove it without manually hunting through the code?\n\nSecretLoop is built around this flow:\n\n**Detect → Verify → Remediate**\n\n`.env`\nThe MCP part was particularly important to get right.\n\nSecretLoop doesn't have an LLM inside it. The scanner produces deterministic findings; the AI assistant can explain and work with those findings.\n\nCredential values are always redacted in MCP responses, and **verification is opt-in and requires explicit human approval before a credential is sent to its provider**.\n\nYou can try it without installing anything:\n\n```\nnpx secretloop scan\n```\n\nOr scan Git history:\n\n```\nnpx secretloop history\n```\n\nFor CI:\n\n```\nnpx secretloop scan --format sarif -o results.sarif\n```\n\nOpen VSX:\n\nGitHub:\n\nIt's still early/Preview, so I'm much more interested in **feedback than downloads**.\n\nIf you use gitleaks, TruffleHog, GitGuardian, GitHub Secret Scanning, etc., I'd especially love to know:\n\n**What happens after your scanner finds a secret?**\n\nThat's the part I'm trying to improve.", "url": "https://wpnews.pro/news/i-built-a-secret-scanner-that-tries-to-answer-is-this-secret-actually-live", "canonical_source": "https://dev.to/prijec31/i-built-a-secret-scanner-that-tries-to-answer-is-this-secret-actually-live-56mn", "published_at": "2026-09-08 19:14:51+00:00", "updated_at": "2026-09-08 19:47:07.872113+00:00", "lang": "en", "topics": ["developer-tools", "ai-tools", "ai-agents"], "entities": ["SecretLoop", "Open VSX", "MCP", "gitleaks", "TruffleHog", "GitGuardian", "GitHub Secret Scanning"], "alternates": {"html": "https://wpnews.pro/news/i-built-a-secret-scanner-that-tries-to-answer-is-this-secret-actually-live", "markdown": "https://wpnews.pro/news/i-built-a-secret-scanner-that-tries-to-answer-is-this-secret-actually-live.md", "text": "https://wpnews.pro/news/i-built-a-secret-scanner-that-tries-to-answer-is-this-secret-actually-live.txt", "jsonld": "https://wpnews.pro/news/i-built-a-secret-scanner-that-tries-to-answer-is-this-secret-actually-live.jsonld"}}