PyPI is the published version of record. Block commits and builds that introduce API keys, tokens and other machine credentials.
Detects 31 credential patterns: AWS IAM keys, GitHub PATs, Stripe secrets, Slack tokens, private keys, and LLM provider keys (OpenAI, Anthropic, Google, Groq, xAI, Replicate).
Free, and it runs entirely on your machine. No account, no API key, no network call. Your source code never leaves the host. Matching happens locally against patterns shipped inside the package.
The pre-commit hook is the point. It runs before the commit enters git history. A CI check only sees the secret after a push, and by then it is in history and has to be rotated even if you delete the commit. The CI integrations below are a backstop, not a substitute.
New in 0.2.0:rsscan --deps counts the accounts that can publish into your npm dependencies. See Counting who can publish your dependencies.
# .pre-commit-config.yamlrepos:
- repo: https://github.com/RelayShield/rsscanrev: v0.2.0hooks:
- id: rsscanpre-commit installThat is the whole setup. Nothing to configure, nothing to sign up for.
- uses: actions/checkout@v4with:
fetch-depth: 0# required: the range needs history
- uses: RelayShield/rsscan@v0.2.0with:
fail-on: HIGHFindings are annotated inline on the changed lines in the pull request's Files tab, so a
developer sees them where the code is rather than in collapsed build output. Blocking findings
(at or above fail-on) appear as errors; everything else appears as warnings.
This needs no token, no permissions: block and no GitHub App. Annotations are emitted as
workflow commands, not through the Checks API. Turn them off with annotate: off if you only
want the log.
Annotations never contain the secret value. Each one carries the credential type, its severity,
and the fingerprint you would add to .relayshield-allowlist to suppress a false positive.
rsscan:
image: relayshield/rsscan:0.2.0variables:
GIT_DEPTH: 0# required: GitLab shallow-clones, and a shallow clone# yields an empty diff, so the job would pass having# scanned nothingRSSCAN_REV_RANGE: "origin/$CI_DEFAULT_BRANCH...HEAD"RSSCAN_FAIL_ON: HIGHscript: ["rsscan"]orbs:
rsscan: relayshield/rsscan@0.1.0workflows:
main:
jobs:
- rsscan/scandocker run --rm -v "$PWD:/workspace" \
-e RSSCAN_REV_RANGE=origin/main...HEAD \
relayshield/rsscan:0.2.0Bitbucket Pipelines:
- step:
script:
- pipe: docker://relayshield/rsscan:0.2.0variables:
RSSCAN_REV_RANGE: "origin/main...HEAD"pip install rsscan
RSSCAN_REV_RANGE="origin/main...HEAD" rsscanScans the diff locally and fails on a finding at or above --fail-on (default HIGH).
Only added lines are scanned. Secrets already in your files are not re-flagged, so the tool does not become unbypassable noise on a repo with legacy findings.
Nothing is transmitted and nothing is printed. There is no scan endpoint to send code to. Matched values never appear in output either: findings carry a file, a line and a non-reversible fingerprint, so a scan is safe to run in CI without leaking the secret into build logs.
rsscan: secrets detected in staged changes
CRITICAL AWS IAM Access Key
src/config.py:14
fingerprint sha256:1a5d44a2dca19669
Commit refused.
Remove the value and load it from a secrets manager or environment
variable instead. If it has already left this machine, rotate it.
False positive? Add the fingerprint to .relayshield-allowlist:
echo 'sha256:1a5d44a2dca19669' >> .relayshield-allowlist
To bypass entirely: git commit --no-verify
Every flag has an environment variable equivalent, which is how the CI clients drive it.
| Flag | Env var | Default | Meaning |
|---|---|---|---|
--fail-on | RSSCAN_FAIL_ON | HIGH | Lowest severity that fails. LOW/MEDIUM/HIGH/CRITICAL. |
--rev-range | RSSCAN_REV_RANGE | (staged) | Scan a commit range instead of staged changes. |
--allowlist | RSSCAN_ALLOWLIST | .relayshield-allowlist | Fingerprints to ignore. |
--report | RSSCAN_REPORT | (off) | Write a shareable exposure report to this path. |
--org | RSSCAN_ORG | (off) | Opt in to reporting adoption for your org domain. |
--strict / --no-strict | RSSCAN_STRICT | see below | Fail when the scan cannot run. |
--annotate | RSSCAN_ANNOTATE | auto | Inline PR annotations. auto enables them inside GitHub Actions only; github forces; off disables. |
--slack-webhook | RSSCAN_SLACK_WEBHOOK | (off) | POST a findings summary to your own Slack incoming webhook. |
--webhook | RSSCAN_WEBHOOK | (off) | POST findings as JSON to an endpoint you control. |
Pre-commit fails open. If the scan genuinely cannot run (an unreadable diff, a broken git invocation), it warns on stderr and lets the commit through. A hook that wedges every commit gets uninstalled, and then it catches nothing.
CI fails closed. A gate that silently reports success when it could not actually run is worse than no gate. It manufactures false assurance. Override either way with --strict / --no-strict or RSSCAN_STRICT.
The allowlist holds fingerprints, not secrets: a file containing the actual values would be the same mistake this tool exists to prevent.
# .relayshield-allowlist
sha256:1a5d44a2dca19669 # documented example key in docs/quickstart.md
Two push channels, both opt-in, both pointing at somewhere you own. (The third delivery channel, inline PR annotations, is automatic in GitHub Actions; see above.) Without one of these flags rsscan makes no network call at all.
# Slack
rsscan --slack-webhook https://hooks.slack.com/services/T000/B000/xxxx
# Any JSON receiver you control
rsscan --webhook https://hooks.example.com/rsscanNone of them ever carries a secret value. Each finding is transmitted as its credential type,
severity, file, line and fingerprint. That is the same guarantee as --report. The Slack message says so
in its own footer, so whoever reads the channel knows it is safe to leave there.
They fire only when there are findings. A notification on every clean build trains people to ignore the channel, which is how a real finding gets missed.
Delivery failure never changes the exit code. If Slack is unreachable, rsscan warns on stderr and the build result stands on the scan alone: a gate should block on secrets, not on a flaky notification endpoint.
The generic webhook posts:
{
"tool": "rsscan", "version": "0.2.0", "scanned": "origin/main...HEAD",
"repo": "acme/api", "ref": "feature/pay", "build_url": "https://github.com/...",
"findings_count": 2, "blocking_count": 2, "highest_severity": "CRITICAL",
"severity_counts": {"CRITICAL": 2},
"findings": [
{"type": "aws_access_key", "severity": "CRITICAL", "description": "AWS IAM Access Key",
"file": "src/config.py", "line": 3, "fingerprint": "sha256:1a5d44a2dca19669"}
],
"detected_at": "2026-08-04T15:00:00+00:00"
}rsscan --deps # auto-detects package-lock.json, then package.json
rsscan --deps path/to/package-lock.json # or point it at oneA self-replicating npm worm does not start with malicious code. It starts with a maintainer account: an infostealer takes the publish token out of somebody's .npmrc, and a patch version nobody reads gets published four steps before there is any artifact for a scanner to analyse.
--deps tells you how large that surface is for your own tree:
Who can publish your dependencies
433 dependencies in package-lock.json
275 distinct publisher accounts can push code into them
126 on personal webmail (no SSO, no central revocation)
28 role or automation addresses
Each package is resolved to its maintainers list plus the _npmUser who actually published the version you would install. Counts are of distinct email addresses, which is a proxy for accounts and imperfect in both directions: one person with two addresses counts twice, two people sharing one count once.
It reads locally and queries only registry.npmjs.org. No account, no API key, no network call to RelayShield, and no telemetry. It prints integers and names nobody.
It always exits 0. There is no dependency count that constitutes a build failure, so this is a report and deliberately not a gate.
If a package cannot be resolved, that count is printed separately and is not folded into the totals. A package whose publishers we could not look up is not a package with no publishers, and collapsing those two into one number is how a tool ends up quietly reassuring you.
rsscan --report exposure.mdWrites a Markdown report you can attach to a ticket or forward by email. It contains no secret values, only fingerprints, so it is safe to share.
rsscan --org yourcompany.comOff by default and entirely optional. When enabled it sends only your org domain, an anonymous per-machine id, the tool version, and how many findings there were by severity.
It never sends file paths, fingerprints, repository names, source code, or the secrets themselves. There is no mechanism in the tool to do so.
rsscan stops credentials before they enter git history. It cannot see credentials that have already left: a key committed last year, or one leaked through a dependency, a published package or a container image, may already be indexed and scraped.
Answering that needs a view of what is public, plus the identity layer secret scanners do not cover at all: workforce credentials surfacing in infostealer logs and breach dumps, SIM-swap risk on staff accounts, and session/token exposure. That is what RelayShield does.
rsscan is free. There is no paid tier of this tool, no scan quota, and no account.
MIT