The Complete Secret Scanner for Cloud-Native Teams
Git repos. Container images. Helm charts. Kubernetes manifests. All in one tool.
go install github.com/redactyl/redactyl@latestSecrets Don't Just Live in Git
They hide in container images, Helm charts, CI/CD artifacts, and nested archives. The things that actually run in production. Redactyl finds them all.
Stream layers directly from registries like Docker Hub, GCR, ECR, and ACR without pulling to disk.
Parse Chart.yaml, values.yaml, and all templates. Catch secrets in your Kubernetes deployments.
Auto-detect Kubernetes resources. Scan Secrets, ConfigMaps, and env vars in Pods and Deployments.
Recursively scan archives within archives. Virtual paths track secrets through every layer.
Know exactly where secrets hide, even in deeply nested artifacts
Built for DevSecOps
From interactive exploration to CI/CD automation. Tools that fit your workflow.
Interactive TUI
Vim-style navigation, severity filtering, and bulk actions. Open findings in your editor, baseline known secrets, or export results.
Gitleaks Detection
200+ battle-tested detection rules from the Gitleaks community. We focus on artifact intelligence, not reinventing regex.
Registry Streaming
Scan remote images directly from Docker Hub, GCR, ECR, or ACR. No disk extraction needed. Layers stream into memory.
Remediation Tools
Forward fixes with redact and dotenv commands. History rewriting with git filter-repo integration and safety backups.
Audit Logging
Immutable JSONL audit trail for compliance. Track findings over time with timestamped scan history.
Privacy First
Zero telemetry by default. Self-hosted friendly. Your secrets and source code never leave your infrastructure.
CI/CD Ready
Native integrations for all major CI platforms. SARIF output for GitHub Code Scanning alerts.
Start Scanning in Seconds
Free and open source. No account required. Install with Go and run your first scan.