fnox scan

• Usage: fnox scan [FLAGS] [DIR]

Scan files for secrets committed in plaintext

Walks DIR and reports lines that look like cloud keys, API tokens, private keys, or password assignments, with the matched value redacted. It skips gitignored files, binary files, files over 5 MiB, and directories such as .git, node_modules, target, and vendor.

fnox exits 1 when it finds anything. Findings are heuristic: review each one, and do not treat a clean scan as proof that no secret is present.

With --values, fnox instead resolves the active profile's secrets and reports every file that contains one of their actual values. This has far fewer false positives than the pattern heuristics. Values are never printed, only the name of the matching secret. Empty secrets and secrets shorter than 8 characters are skipped. Add --staged to check the content staged in git (the index) rather than the working tree, and --install-hook to install a pre-commit hook that runs fnox scan --values --staged.

Arguments

• [DIR] — Directory to scan

  Default: .

Flags

• -i --ignore <IGNORE> — Skip files whose path or name matches this glob; repeatable

• -q --quiet — Print only the paths of files with findings

• --append — With --install-hook, append to an existing pre-commit hook instead of refusing

• --format <FORMAT> — Output format

  Choices: human, json

  Default: human

• --include-ignored — Also scan files ignored by .gitignore (working tree scans only)

• --install-hook — Install a git pre-commit hook that runs fnox scan --values --staged

• --staged — Scan content staged in git (the index) instead of the working tree

• --values — Resolve the active profile's secrets and report files containing their values

• -h --help — Print help

Examples

Scan the current directory

fnox scan

Print findings as JSON

fnox scan . --format json

Skip matching files

fnox scan . --ignore 'fixtures/**'

Find files containing this profile's real secret values

fnox scan --values

Check only what is staged for commit

fnox scan --values --staged

Install a pre-commit hook that scans staged secrets

fnox scan --install-hook

See also

• Import and export