odomojuli/regextokens
Scan for leaked API tokens and secrets with sourced, tested regex patterns, scored by offline proof (checksums, decoders, entropy — no network calls). Emits SARIF for GitHub code scanning.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 2, 2026
- License
- MIT
Pinned Snippet
uses: odomojuli/regextokens@1c80404e0bda64485fd2d14568f7b211e404c33c # no releases — HEAD as of 2026-07-11tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| path | File or directory to scan (relative to the workspace). | — | . |
| min-confidence | Only report findings at or above this tier: low, probable, or verified. Default is probable; low includes public identifiers and placeholders. | — | probable |
| baseline | Path to a .regextokens-baseline.json of accepted findings to suppress. Empty (default) means no baseline. | — | "" |
| sarif-file | Where to write the SARIF report. | — | regextokens.sarif |
| fail-on-findings | Fail the step when findings remain after baseline filtering (true/false). | — | true |
Outputs
| name | description |
|---|---|
| sarif-file | Path to the SARIF report (feed to github/codeql-action/upload-sarif). |
| findings | Number of findings reported. |