Secrets Free

Install Secrets Free

Secrets Free needs macOS 14 or later and runs on Apple silicon and Intel Macs. After purchasing, connect GitHub in Polar and accept the repository invitation. Download Secrets-Free-1.0.0.zip from the private Secrets Free releases, unzip it, and move Secrets Free.app to Applications. The download is signed and notarized by Apple.

Git must be on your PATH for repository-aware scans and history. The ordinary Git included with the macOS developer command-line tools is enough.

Scan your first project

Open the app and choose Scan Folder…, then select a local project. Inside a Git repository, Secrets Free scans tracked and untracked files while skipping ignored files. Select a finding to see its severity, detection rule, path, line number, fingerprint and redacted context.

Use Rescan or Command-R after changing the project. The options menu adds three wider or narrower scans:

• Git history checks every commit on every branch.
• Ignored files includes Git-ignored files and heavy folders.
• Identity controls email, home-path, private-IP and account-ID rules.

Saved reports live at ~/Library/Application Support/SecretsFree/reports.json. Saved secret values are redacted. Reveal is available only for a finding from the current live scan.

Install and use the CLI

The source repository includes an installer:

./Scripts/install-cli.sh

It builds the release command and links it into ~/.local/bin. Pass another directory when needed, for example ./Scripts/install-cli.sh /opt/homebrew/bin.

Scan the current folder, then add history when you need it:

secretsfree scan
secretsfree scan --history

Useful options include:

secretsfree scan --include-ignored
secretsfree scan --no-identity
secretsfree scan --min-severity high
secretsfree scan --history --fail-on medium --json

scan exits 1 when a finding reaches --fail-on, which defaults to high. It exits 0 otherwise, 2 for invalid usage and 3 when the scan fails. Use --fail-on never to always return 0, and --quiet when only findings should be printed.

--json keeps status text out of standard output. Secret fields remain redacted unless you also pass --reveal. Be careful with --reveal: terminal history, logs and redirected files can keep the value.

Stop a push with a hook

Create .git/hooks/pre-push in the repository you want to protect:

#!/bin/sh
secretsfree scan --quiet

Make the hook executable with chmod +x .git/hooks/pre-push. The default threshold stops the push for high and critical findings. Run a history scan separately when you also want to inspect old commits.

For CI or a coding agent that will evaluate structured results:

secretsfree scan --history --json --fail-on never > secrets.json

Review and allowlist a finding

Remove or rotate a real credential. If the match is an intentional fixture or example, allowlist the narrowest useful scope.

Copy its 12-character fingerprint from the app or CLI and run:

secretsfree ignore 3f9c2a1d8e7b

Ignore one rule or path pattern when every match in that scope is expected:

secretsfree ignore --rule email-address
secretsfree ignore --glob 'fixtures/**'

These commands update .secretsfree.json in the scanned root. Commit that file so everyone uses the same reviewed exceptions. Add secretsfree:ignore to a source comment for a single intentional line.

Use secretsfree rules to list all detection rules and their severity. secretsfree help scan and secretsfree help ignore show the complete command options.

Build from source

The purchase includes the full MIT-licensed Swift source. Xcode 26 or a Swift 6.2 toolchain is required to build it.

swift test
./Scripts/build-app.sh
open "dist/Secrets Free.app"

The build script makes a universal app. Without Flavio’s Developer ID certificate it uses an ad-hoc signature, so macOS can ask for confirmation when you open your own build.

Secrets Free scans local folders only. It does not clone remote repositories or upload files. False positives are possible, so review each finding before removing or allowlisting it. Updates are downloaded manually from the private Releases page.