Rustywoof: Dev's Best Friend

In March 2026 I was in the middle of a normal coding session when the news started coming in. Popular packages had been hijacked. Developer accounts were taken over. Keys that someone had pasted into a file by mistake were being found and used within minutes. I closed my laptop lid and just sat there for a while. I kept asking myself one thing: how many of my own projects had the same problem and I just didn't know?

If you are not a developer, here is the short version. Software is built from thousands of small pieces written by strangers. If one piece goes bad, everything built on top of it can go bad too. And developers sometimes leave secret passwords sitting inside their code, a bit like leaving your house key under the doormat. Attackers know exactly where to look.

I went looking for tools to check my work. There are good ones, but each does one small job. For a project that mixes Rust, TypeScript and Python, I needed three or four different tools (npm audit, cargo audit, pip-audit) just to check my dependencies. I wanted one tool that does it all in a single run, so I built it.

Most secret scanners take a long list of patterns and test every single line of every file against all of them. Add more files or more patterns and the wait grows. But here is the thing. Nearly every real key starts with a fixed beginning. AWS keys start with AKIA, GitHub tokens start with ghp_, and Stripe keys start with sk_live_.

So Rustywoof does not read everything closely. It first sweeps your files once, looking only for those known beginnings, using a method called Aho-Corasick. Think of scanning a whole library for a handful of book titles instead of reading every page. If a file has none of them, I skip it. If one shows up, I look closer. I also measure how random the text looks (this is called Shannon entropy), because real keys look messy and fake ones like AKIA_EXAMPLE_TOKEN don't. That keeps the false alarms down.

Here is the kind of mistake it catches. Someone pastes a GitHub token straight into a file to “just test something quickly” and forgets about it. Every developer has done this at least once. Line 4 below is the problem.

Now I run woof scan . on the project. It reads 21,341 files, about 577 MiB, and it still finishes in 2.42 seconds. It tells you the file, the line, the column, and what kind of secret it found. It also hides the key in its own report, so the scanner never becomes the next leak.

If you are not technical, think of it as a metal detector for your code. It beeps when it finds something that should never have been there, and it points to the exact spot. It works the same way for Rust and Python projects, and it knows about AWS keys and Google Cloud keys too.

The dangerous stuff is rarely the library you picked yourself. It is usually something three or four layers down that you have never heard of. So woof audit does not guess from loose version ranges in package.json or Cargo.toml. It reads the exact versions you are really using from Cargo.lock, package-lock.json, pnpm-lock.yaml, uv.lock and poetry.lock. Then it asks api.osv.dev, a public list of known vulnerabilities, about all of them in one request.

Here is a real run on a tiny shop project with just three libraries. All three had known problems. For each one you get the version you are on, how serious it is, and the exact command to fix it.

If you are not technical, read it like a health check for your software. Each block is one ingredient, how risky it is, and what to swap it for. If you are a developer, the woof sniff line helps you see where the package sits in your tree before you upgrade, so the fix does not break something else.

Your code, file names and environment variables never leave your computer. When Rustywoof finds a secret, it hides most of it in the report, so you are not leaking it again by accident. The Playground on this site runs the very same scanner inside your browser tab, so nothing gets uploaded there either.

I am one person building this, and I am still learning as I go. If it saves you from one bad commit, it was worth it. Try it on a project and tell me what you find.