Secret scanning for any file: bolvrk secrets
The same credential rules over .env, YAML, JSON, source and shell — line-indexed findings in the same contract, same policy overrides, SARIF for code scanning. Always local: a credential scan never leaves the machine.
bolvrk secrets runs the credential rules over any file, line by line: .env files, YAML, JSON, source code, shell scripts. A text-only rule adds secret-named settings assigned a literal (BC006). Findings are line-indexed, in the same JSON contract as check, with the same policy overrides and the same SARIF output for code scanning.
It reads a pipe as well as files. A deploy script that prints a token, a CI job whose error echoes a connection string, a command whose output is about to be pasted into a ticket: pipe it through bolvrk secrets - and a match means the value was printed, which is the leak itself.
It has no remote mode by design. A credential scan reads the most sensitive files in a repository, and the right number of copies of those to send anywhere is zero.
npx bolvrk secrets "src/**" ".env*"
# or keep the globs in bolvrk.json
{ "secrets": ["src/**", ".env*", "deploy/**/*.yml"] }
# or scan what a command prints, before it lands in a log or a ticket
./deploy.sh 2>&1 | npx bolvrk secrets -Suppression
A deliberate fixture value is silenced the same way as any finding: bolvrk-ignore BC006: reason on the line or the line above, in any comment syntax. The reason is required, and every suppression is recorded in the report.
The CLI is open source and needs no account: npx bolvrk check migration.sql