Scanners watch git.
Your keys live in chat.
gitleaks and trufflehog scan history. The transcript is the new leak surface — pastes, file reads, tool output. token-hunt hooks the agent runtime itself, at all six points a secret can enter.
$ echo "ANTHROPIC_API_KEY=sk-ant-…" > notes.txt
$ token-hunt scan notes.txt
● LEAK anthropic_api_key notes.txt:1
fingerprint 9f2c…e41a action BLOCKED
→ rotate at console.anthropic.com, then:
$ token-hunt close 1 --note "rotated"01 Six hooks. Every entry point.
| hook | what it sees | action on leak |
|---|---|---|
UserPromptSubmit | your paste | WARN |
PreToolUse:Bash | command about to run | BLOCK |
PostToolUse:Bash | command output | WARN + log |
PostToolUse:Read | file contents | WARN + log |
PreToolUse:Edit/Write | new file content | BLOCK |
PostToolUse:Edit/Write | echo | WARN + log |
02 Catches what regex can't.
Bash evaluates secrets into emitted text with no literal in sight. token-hunt runs a runtime detector for the escape-hatch class — no other scanner sees it.
BLOCKED
echo ${ANTHROPIC_API_KEY:+SET}
${ANTHROPIC_API_KEY:-UNSET}both branches run — the value leaks
BLOCKED
echo $GITHUB_TOKENdirect echo of a secret var
ALLOWED
[ -n "$ANTHROPIC_API_KEY" ] \
&& echo SETstatus check — no value emitted
03 Three shapes. One hunt.
01token-huntfree · MITThe engine. CLI (scan / list / close / watch), six hooks with block-and-rotate behavior, the allowlist, and the bash escape-hatch runtime detector no regex can see.→02pat-scannerfree · MITThe one-command plugin. One hook, 13 credential classes, regex matching. Install it and you're covered. The guard, without the workflow.→03token-hunt-procommercialSilent redaction — the agent never sees the raw value. Active verification — checks whether a found key is actually live against GitHub, Stripe, and Slack. Offline ed25519 licensing. Zero phone-home.→11 providers built in
- Z.ai
- Anthropic
- GitHub
- GitLab
- Figma
- PyPI
- npm
- Linear
- Stripe
- OpenAI
- Slack