Secret Injection Diff

Local configuration audit / v0.1.0

Prove which process gets each secret

For developers reviewing CI and deploy changes before an unexpected process gains a credential.

Try it with sample data Watch a new recipient fail the check.
  • Runs locally · no network calls
  • Reports names · never values
  • Free · MIT licensed
A cutaway conservatory shows glowing capsules routed into separate plant rooms.

Specimen 02

See the new edge before merge

The check compares the current recipient graph with a committed baseline.

release.yml / recipient diff

        

      

    


    

      

        
Field method
Review scope in three commands
The baseline stays in your repository beside the configuration it describes.

        
    
          
  1. Scan configuration
    Read secret identifiers from supported files and map each recipient.
    2. 
          
  2. Commit the baseline
    Review the JSON graph once, then approve it with the pull request.
    3. 
          
  3. Check every change
    Exit code 2 stops CI when a new recipient edge appears.
    4. 
        

      

    


    

      

        
Known terrain
Explicit adapters, clear limits
  • .env and .env.*
  • Docker Compose
  • GitHub Actions
  • Kubernetes workloads

        
Outside the fence
What it does not do
  • It does not read secret stores.
  • It does not decrypt values.
  • It does not watch running processes.
  • It does not guess vendor behavior.

      

    


    

      

        
Start with your repository

        
Install the local CLI

        
cargo install --git https://github.com/B-Divyesh/sf-secret-injection-diff

        

        
Then run secret-injection-diff scan .