Whac-a-Leak (whac)
Whac-a-Leak is a pure-Go secret scanner. CUE defines its rules. Each rule has a type, organization layers and its own samples. If a sample fails, whac does not load the rules.
The scan is plain Go. An Aho-Corasick keyword pass runs first. Only the rules with a keyword hit run their regex and charset-aware entropy checks, on the lines around the keyword. whac reads YAML, JSON, .env, properties, INI and HCL files as key paths. Allowlists use whac1: fingerprints, which do not change on a rebase.
v0.2.0 is the current release. The 0.x version means that options and formats can change before 1.0. The ADRs record the design.
Features
- 32 builtin rules. They cover cloud providers, code hosts, SaaS APIs, package registries, Vault, private keys, JWTs and passwords in URLs. See Default Rules.
- Organization layers in
.whac/*.cue: add, tighten, disable or re-grade rules without a fork.
- Scan a directory, the staged changes (pre-commit) or the git history.
- Audit an AI agent's context before it starts: environment variables, credential files and credential sockets (
--agent-context).
- Text, JSON and SARIF 2.1.0 output. whac redacts secrets by default.
- About 180 MB/s on one core. Fully offline.
Install
Download the archive for your platform from the v0.2.0 release: Linux or macOS, amd64 or arm64. Verify it with SHA256SUMS and gh attestation verify. Or run go install github.com/infrashift/whac-a-leak/cmd/[email protected].
Quick start
make build # → bin/whac (Go 1.25+, CGO_ENABLED=0)
bin/whac scan . # scan the work tree; exit 1 on findings
bin/whac scan --staged # pre-commit: scan only the lines you add
bin/whac scan --git # scan every commit in the history
bin/whac scan --format sarif . # SARIF for GitHub code scanning
bin/whac scan --agent-context # preflight: what can an agent reach?
bin/whac rules verify # run the samples of every rule
For the pre-commit framework, use the hook whac from this repository.
Documentation
License
Apache License 2.0. See LICENSE.
