r/PythonProjects2 • u/Next_Improvement_475 • 6d ago

I made a Python library that stops secrets from being printed to the terminal

I kept thinking about a pretty stupid way to leak an API key:

api_key = "sk-example123456"

print(api_key)

Nothing gets committed to GitHub.
Nothing gets pushed anywhere.

But now the secret is sitting right there in the terminal/logs.

So I built SecretShield.

It's a small, local Python security utility that watches stdout, stderr, and Python logging and automatically redacts strings that look like secrets before they are displayed.

API_KEY=sk-example123456
        ↓
API_KEY=********

The goal isn't to replace GitHub secret scanners or tools like GitGuardian.

It's for the "I'm debugging something locally and accidentally printed a credential" problem.

It's dependency-free and can be enabled with a simple import.

I'm curious:

Would you actually use something like this in a Python project, or is this solving a problem that isn't annoying enough to matter?

GitHub discussion: https://github.com/orgs/localghosters/discussions/1

6 Upvotes
  • permalink
  • reddit

100% Upvoted

2 comments sorted by

2

u/sastuvel 2d ago

strings that look like secrets

How do you identify those strings?

1

u/Next_Improvement_475 2d ago

It uses a combination of pattern matching and entropy-based detection.

For known credential formats, SecretShield has patterns for things like API keys, tokens, private keys, passwords, etc. For less predictable secrets, it can also flag high-entropy credential-shaped strings.

It's deliberately heuristic rather than claiming that it can know with 100% certainty that something is a secret. That's also why the project treats false positives as an important limitation.

The idea is basically: known secret patterns + contextual/entropy signals → likely secret → redact it.It uses a combination of pattern matching and entropy-based detection.

For known credential formats, SecretShield has patterns for things like API keys, tokens, private keys, passwords, etc. For less predictable secrets, it can also flag high-entropy credential-shaped strings.

It's deliberately heuristic rather than claiming that it can know with 100% certainty that something is a secret. That's also why the project treats false positives as an important limitation.

The idea is basically: known secret patterns + contextual/entropy signals → likely secret → redact it.