# eslint-plugin-no-secrets > An eslint rule that searches for potential secrets/keys in code Latest version **2.3.3** (published 2026-03-01) · MIT license · 0 weekly downloads ## Install ```sh npm install eslint-plugin-no-secrets pnpm add eslint-plugin-no-secrets yarn add eslint-plugin-no-secrets bun add eslint-plugin-no-secrets ``` ## Health **Score 55/100 (C)** — status: stable. Positive: has types; no vulnerabilities; high quality score. Warnings: low downloads; no esm support. ## Facts | | | |---|---| | Version | 2.3.3 | | Published | 2026-03-01 | | First published | 2019-03-29 | | Weekly downloads | 0 | | License | MIT | | TypeScript types | bundled | | Module format | CommonJS | | Node | >=18 | | Dependencies | 0 | | Unpacked size | 39.2 KB | | Known vulnerabilities | 0 | | Install scripts | no | | GitHub stars | 168 | | Author | Nick Deis | | Maintainers | nickdeis | | Keywords | eslint, eslint-plugin, security, secure, secrets, lint, eslintplugin | ## Links - npm: https://www.npmjs.com/package/eslint-plugin-no-secrets - Repository: https://github.com/nickdeis/eslint-plugin-no-secrets - Homepage: https://github.com/nickdeis/eslint-plugin-no-secrets#readme - Issues: https://github.com/nickdeis/eslint-plugin-no-secrets/issues - npm.io page: https://npm.io/package/eslint-plugin-no-secrets ## Alternatives - [eslint-plugin-sonarjs](https://npm.io/package/eslint-plugin-sonarjs.md) — 2.9M weekly downloads - [eslint-config-expo](https://npm.io/package/eslint-config-expo.md) — 1.5M weekly downloads - [@matter/protocol](https://npm.io/package/@matter/protocol.md) — 63.5K weekly downloads - [@eventcatalog/linter](https://npm.io/package/@eventcatalog/linter.md) — 24.8K weekly downloads - [@pandacss/eslint-plugin](https://npm.io/package/@pandacss/eslint-plugin.md) — 18.7K weekly downloads ## Recent versions - 2.3.3 (latest) — 2026-03-01 - 2.2.2 — 2026-02-10 - 2.2.1 — 2025-02-04 - 2.2.1-rc1 — 2025-02-01 - 2.1.1 — 2024-12-04 - 2.1.1-rc.0 — 2024-12-01 - 1.1.2 — 2024-11-05 - 1.0.2 — 2024-05-12 - 0.9.1 — 2024-04-19 - 0.9.0 — 2024-04-19 - 1.0.1-eslint9 — 2024-04-19 - 1.0.0-eslint9 — 2024-04-19 - 0.8.9 — 2021-02-27 - 0.7.9 — 2021-02-20 - 0.6.8 — 2020-04-21 - … 9 more at https://npm.io/package/eslint-plugin-no-secrets/versions ## README [![Build Status](https://github.com/nickdeis/eslint-plugin-no-secrets/actions/workflows/main.yml/badge.svg)](https://github.com/nickdeis/eslint-plugin-no-secrets/actions/workflows/main.yml/badge.svg) # eslint-plugin-no-secrets An eslint rule that searches for potential secrets/keys in code and JSON files. This plugin has two rules: - `no-secrets`: Find potential secrets using cryptographic entropy or patterns in the AST (acts like a standard eslint rule, more configurable) - `no-pattern-match`: Find potential secrets in text (acts like `grep`, less configurable, but potentially more flexible) --- - 1. [Usage](#Usage) - 1.1. [Flat config](#Flatconfig) - 1.2. [eslintrc](#eslintrc) - 1.3. [Include JSON files](#IncludeJSONfiles) - 1.3.1. [Include JSON files with in "flat configs"](#IncludeJSONfileswithinflatconfigs) - 2. [`no-secrets`](#no-secrets) - 2.1. [`no-secrets` examples](#no-secretsexamples) - 2.2. [When it's really not a secret](#Whenitsreallynotasecret) - 2.2.1. [ Either disable it with a comment](#Eitherdisableitwithacomment) - 2.2.2. [ use the `ignoreContent` to ignore certain content](#usetheignoreContenttoignorecertaincontent) - 2.2.3. [ Use `ignoreIdentifiers` to ignore certain variable/property names](#UseignoreIdentifierstoignorecertainvariablepropertynames) - 2.2.4. [ Use `additionalDelimiters` to further split up tokens](#UseadditionalDelimiterstofurthersplituptokens) - 2.3. [`no-secrets` Options](#no-secretsOptions) - 3. [`no-pattern-match`](#no-pattern-match) - 3.1. [`no-pattern-match` options](#no-pattern-matchoptions) - 4. [Acknowledgements](#Acknowledgements) ## 1. Usage `npm i -D eslint-plugin-no-secrets` ### 1.1. Flat config _eslint.config.js_ ```js import noSecrets from "eslint-plugin-no-secrets"; export default [ { files: ["**/*.js"], plugins: { "no-secrets": noSecrets, }, rules: { "no-secrets/no-secrets": "error", }, }, ]; ``` ### 1.2. eslintrc _.eslintrc_ ```json { "plugins": ["no-secrets"], "rules": { "no-secrets/no-secrets": "error" } } ``` ```js //Found a string with entropy 4.3 : "ZWVTjPQSdhwRgl204Hc51YCsritMIzn8B=/p9UyeX7xu6KkAGqfm3FJ+oObLDNEva" const A_SECRET = "ZWVTjPQSdhwRgl204Hc51YCsritMIzn8B=/p9UyeX7xu6KkAGqfm3FJ+oObLDNEva"; //Found a string that matches "AWS API Key" : "AKIAIUWUUQQN3GNUA88V" const AWS_TOKEN = "AKIAIUWUUQQN3GNUA88V"; ``` ### 1.3. Include JSON files To include JSON files, install `eslint-plugin-jsonc` or `@eslint/json` (if using ESLint version 9.6 or above) `npm install --save-dev eslint-plugin-jsonc` Then in your `.eslint` configuration file, extend the jsonc base config ```json { "extends": ["plugin:jsonc/base"] } ``` or if you are using ESLint 9.6 or above ```typescript module.exports = [ { plugins: { json, "no-secrets": noSecret, }, }, { files: ["**/*.json"], language: "json/json", .... }, ]; ``` #### 1.3.1. Include JSON files with in "flat configs" _eslint.config.js_ ```js import noSecrets from "eslint-plugin-no-secrets"; import jsoncExtend from "eslint-plugin-jsonc"; export default [ ...jsoncExtend.configs["flat/recommended-with-jsonc"], { languageOptions: { ecmaVersion: 6 }, plugins: { "no-secrets": noSecrets, }, rules: { "no-secrets/no-secrets": "error", }, }, ]; ``` ## 2. `no-secrets` `no-secrets` is a rule that does two things: 1. Search for patterns that often contain sensitive information 2. Measure cryptographic entropy to find potentially leaked secrets/passwords It's modeled after early [truffleHog](https://github.com/dxa4481/truffleHog), but acts on ECMAscripts AST. This allows closer inspection into areas where secrets are commonly leaked like string templates or comments. ### 2.1. `no-secrets` examples Decrease the tolerance for entropy ```json { "plugins": ["no-secrets"], "rules": { "no-secrets/no-secrets": ["error", { "tolerance": 3.2 }] } } ``` Add additional patterns to check for certain token formats. Standard patterns can be found [here](./regexes.js) ```json { "plugins": ["no-secrets"], "rules": { "no-secrets/no-secrets": [ "error", { "additionalRegexes": { "Basic Auth": "Authorization: Basic [A-Za-z0-9+/=]*" } } ] } } ``` ### 2.2. When it's really not a secret #### 2.2.1. Either disable it with a comment ```javascript // Set of potential base64 characters // eslint-disable-next-line no-secrets/no-secrets const BASE64_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="; ``` This will tell future maintainers of the codebase that this suspicious string isn't an oversight #### 2.2.2. use the `ignoreContent` to ignore certain content ```json { "plugins": ["no-secrets"], "rules": { "no-secrets/no-secrets": ["error", { "ignoreContent": "^ABCD" }] } } ``` #### 2.2.3. Use `ignoreIdentifiers` to ignore certain variable/property names ```json { "plugins": ["no-secrets"], "rules": { "no-secrets/no-secrets": [ "error", { "ignoreIdentifiers": ["BASE64_CHARS"] } ] } } ``` #### 2.2.4. Use `additionalDelimiters` to further split up tokens Tokens will always be split up by whitespace within a string. However, sometimes words that are delimited by something else (e.g. dashes, periods, camelcase words). You can use `additionalDelimiters` to handle these cases. For example, if you want to split words up by the character `.` and by camelcase, you could use this configuration: ```json { "plugins": ["no-secrets"], "rules": { "no-secrets/no-secrets": [ "error", { "additionalDelimiters": [".", "(?=[A-Z][a-z])"] } ] } } ``` ### 2.3. `no-secrets` Options | Option | Description | Default | Type | | -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ------------------------------------------- | | tolerance | Minimum "randomness"/entropy allowed. Only strings **above** this threshold will be shown. | `4` | `number` | | additionalRegexes | Object of additional patterns to check. Key is check name and value is corresponding pattern | `{}` | {\[regexCheckName:string]:string \| RegExp} | | ignoreContent | Will ignore the _entire_ string if matched. Expects either a pattern or an array of patterns. This option takes precedent over `additionalRegexes` and the default regular expressions | `[]` | string \| RegExp \| (string\|RegExp)[] | | ignoreModules | Ignores strings that are an argument in `import()` and `require()` or is the path in an `import` statement. | `true` | `boolean` | | ignoreIdentifiers | Ignores the values of properties and variables that match a pattern or an array of patterns. | `[]` | string \| RegExp \| (string\|RegExp)[] | | ignoreCase | Ignores character case when calculating entropy. This could lead to some false negatives | `false` | `boolean` | | additionalDelimiters | In addition to splitting the string by whitespace, tokens will be further split by these delimiters | `[]` | (string\|RegExp)[] | ## 3. `no-pattern-match` While this rule was originally made to take advantage of ESLint's AST, sometimes you may want to see if a pattern matches any text in a file, kinda like `grep`. For example, if we configure as follows: ```js import noSecrets from "eslint-plugin-no-secrets"; //Flat config export default [ { files: ["**/*.js"], plugins: { "no-secrets": noSecret, }, rules: { "no-secrets/no-pattern-match": [ "error", { patterns: { SecretJS: /const SECRET/, SecretJSON: /\"SECRET\"/ } }, ], }, }, ]; ``` We would match `const SECRET`, but not `var SECRET`. We would match keys that were called `"SECRET"` in JSON files if they were configured to be scanned. ### 3.1. `no-pattern-match` options | Option | Description | Default | Type | | -------- | ----------------------------------------------------------------- | ------- | ------------------------------------------- | | patterns | An object of patterns to check the text contents of files against | `{}` | {\[regexCheckName:string]:string \| RegExp} | ## 4. Acknowledgements Huge thanks to [truffleHog](https://github.com/dxa4481/truffleHog) for the inspiration, the regexes, and the measure of entropy. --- _Source: https://npm.io/package/eslint-plugin-no-secrets · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._