How This VSCode Extension Saves Your Code from Exposed Secrets?

As developers, we’ve all been there—pushing code in a rush, only to realize moments later that we’ve accidentally committed sensitive information. Maybe it’s an API key, a database password, or a token that should have stayed private. The fallout can range from mild embarrassment to a full-blown security breach.

This exact scenario happened to me. That one careless push led to hours of damage control: revoking keys, updating configurations, and patching vulnerabilities. It was frustrating, but more than that, it got me thinking: Why are we relying on post-commit tools to catch these mistakes? Why not prevent them before they even hit Git?

That’s when I decided to build SecretStack, a Visual Studio Code extension designed to solve this problem at its root.

The Problem: Secrets in Code

Exposing sensitive information in your code is a common yet costly mistake. While there are great tools like git-secrets and truffleHog that scan repositories for secrets, they often operate after the fact. By the time they flag something, the damage might already be done:

• The secret is in your commit history.


• It could be cached in forks or clones.


• Revoking and rotating keys becomes an urgent task.

In short, these tools are reactive, not proactive.

The Solution: SecretStack

SecretStack takes a different approach. It integrates directly into your coding workflow, scanning your files before you commit. The goal is simple: to help you catch exposed secrets early, so they never make it into your repository in the first place.

What Makes SecretStack Unique?

Here’s what SecretStack brings to the table:

1. Manual Scan Control

You’re in charge. With a single click on the Find Exposed Secrets button in the VSCode status bar, you can scan your entire workspace or specific folders. No automatic scans interrupting your workflow—just actionable insights when you need them.

2. Custom Pattern Detection

Every project is different, and so are the secrets it might contain. SecretStack lets you define custom regex patterns to detect specific types of secrets, like API keys, tokens, or internal credentials.

For example, you can add patterns like this to your settings:

"secret-stack.customPatterns": [

    {

        "name": "AWS Access Key",

        "regex": "AKIA[0-9A-Z]{16}",

        "severity": "High"

    },

    {

        "name": "GitHub Token",

        "regex": "ghp_[A-Za-z0-9_]{36}",

        "severity": "Medium"

    }

]

3. Real-Time Feedback

SecretStack provides instant, time-stamped updates during scans. You’ll know how many files were scanned and whether any secrets were detected, all without leaving your editor.

4. Comprehensive Logs and Reports

After every scan, SecretStack generates:

• A detailed log in .secret-stack-result.log, showing which files were scanned and what was detected.


• A visual HTML report in .secret-stack-report.html, summarizing detected secrets, their severity, and file locations.
  By default, these files are added to .gitignore to prevent accidental commits.

5. Pre-Commit Scan Reminder

Ever forget to run a scan before committing? SecretStack has your back with a gentle nudge to run a quick scan before pushing your code.

6. Handling False Positives

Not every flagged item is a real secret. For example, test keys or mock data might trigger a false positive. SecretStack makes it easy to dismiss these by clicking Ignore in the results view. This keeps your logs clean and focused on real risks.

How to Get Started with SecretStack

1. Install the Extension

Search for SecretStack in the VSCode Extensions Marketplace and click Install. Alternatively, download the .vsix file from the

Your feedback and contributions could shape the future of SecretStack. Let’s catch those secrets before they catch us.