Totally agree, and I do hope that at some point this will be standardised. Ideally you’d have an endpoint that returns a set of patterns to check for and a way

Totally agree, and I do hope that at some point this will be standardised. Ideally you’d have an endpoint that returns a set of patterns to check for and a way to submit a set of tokens for checking, along with some kind of context. It would probably be something like what GitHub requires[1]. Unfortunately that has somewhat limited value when GitHub can do most of the legwork for you, and as the de-facto place to publish code the majority of “accidental secrets exposed in code” are leaked there. 1. https://docs.github.com/en/code-security/secret-scanning/secret-scanning-partner-program#create-a-secret-alert-service https://docs.github.com/en/code-security/secret-scanning/sec...