scan_secrets.js

const fs = require("fs");
const parser = require("@babel/parser");
const traverse = require("@babel/traverse").default;

PATTERNS = [
  /BEGIN ((EC|PGP|DSA|RSA|OPENSSH) )?PRIVATE KEY/,
  /AIza[A-Za-z0-9_-]{35}/,
  /sk_live_[A-Za-z0-9]{24}/,
];

function isSecret(string) {
  return PATTERNS.some((pattern) => string.match(pattern));
}

process.argv.slice(2).forEach((fileName) => {
  const ast = parser.parse(fs.readFileSync(fileName, "utf8"), {
    errorRecovery: true,
  });

  traverse(ast, {
    StringLiteral(path) {
      if (isSecret(path.node.value)) {
        const { start, end } = path.node.loc;
        console.log(`${fileName}: ${start.line}:${end.line}`);
      }
    },
  });
});