sf-keyaudit

A fast, CI-friendly command-line tool that scans codebases for exposed AI API keys across all major providers.

Exit 0 when clean. Exit 1 when findings are detected. Designed to drop straight into a pre-push or pre-merge pipeline as a hard gate.

Supported providers

Installation

From crates.io

cargo install sf-keyaudit

From source

git clone https://github.com/veerarag1973/sf-keyaudit
cd sf-keyaudit
cargo build --release
# binary is at target/release/sf-keyaudit

Quick start

# Scan the current directory
sf-keyaudit

# Scan a specific path
sf-keyaudit ./my-project

# Scan a single file
sf-keyaudit src/config.py

# Output SARIF (for GitHub Code Scanning)
sf-keyaudit --format sarif --output results.sarif .

# Scan only for specific providers
sf-keyaudit --providers openai,anthropic .

# Stop on the first finding (fast CI gate)
sf-keyaudit --fail-fast .

CLI reference

sf-keyaudit [OPTIONS] [PATH]

Exit codes

Output formats

JSON (default)

{
  "scan_id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "tool": "sf-keyaudit",
  "version": "1.0.0",
  "timestamp": "2026-04-03T10:00:00Z",
  "scan_root": "/home/user/my-project",
  "files_scanned": 42,
  "findings": [
    {
      "id": "f-001",
      "provider": "openai",
      "file": "src/config.py",
      "line": 12,
      "column": 14,
      "match": "sk-proj-***REDACTED***",
      "pattern_id": "openai-project-key-v2",
      "severity": "critical",
      "entropy": 4.87
    }
  ],
  "low_confidence_findings": [],
  "summary": {
    "total_findings": 1,
    "by_provider": { "openai": 1 },
    "files_with_findings": 1
  }
}

The match field always contains ***REDACTED*** in place of the secret body — the raw key value never appears in the output.

SARIF

sf-keyaudit --format sarif --output results.sarif .

Produces a SARIF 2.1.0 document compatible with GitHub Code Scanning, Azure DevOps, and Visual Studio.

Ignoring files

.sfignore

Place a .sfignore file in the root of the scanned directory. It uses the same gitignore pattern syntax.

# .sfignore
tests/fixtures/
*.test.env
docs/

--ignore-file

Pass one or more external ignore files on the command line. Repeatable.

sf-keyaudit --ignore-file .myignore --ignore-file team.gitignore .

Allowlist

Suppress known-safe findings permanently or until an expiry date.

Create .sfkeyaudit-allow.yaml (or any path, then pass it with --allowlist):

allowlist:
  - pattern_id: openai-legacy-key-v1
    file: tests/fixtures/mock_key.py
    line: 3
    reason: "Test fixture — not a live credential"

  - pattern_id: aws-access-key-id-v1
    file: docs/examples/terraform.tf
    line: 7
    reason: "Example value from AWS docs, not a real key"
    expires: "2027-01-01"

Run with the allowlist:

sf-keyaudit --allowlist .sfkeyaudit-allow.yaml .

Exit code 4 is returned when the scan is clean but the allowlist has entries that are expired or that no longer match any finding. Use this to keep allowlists tidy.

CI integration

GitHub Actions

name: Secret scan
on: [push, pull_request]

jobs:
  keyaudit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install sf-keyaudit
        run: cargo install sf-keyaudit

      - name: Scan for exposed API keys
        run: sf-keyaudit --fail-fast --quiet .

To upload SARIF results to GitHub Code Scanning:

      - name: Scan (SARIF)
        run: sf-keyaudit --format sarif --output results.sarif . || true

      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif

Always-excluded directories

The following directories are skipped regardless of ignore settings:

.git, node_modules, target, dist, .venv, venv, vendor, __pycache__, .mypy_cache, .pytest_cache, build, .next, .nuxt

License

MIT