Question: Can you recommend a tool that scans my code for hardcoded secrets and API keys?

If you're looking for a tool to scan your code for hardcoded secrets and API keys, GitGuardian is a top option. It monitors your Git repositories for sensitive data like API keys, passwords, certificates and encryption keys, with real-time detection, custom secret detectors and remediation tools. It's a good option for Dev, Sec and Ops teams and can be used for internal monitoring to prevent secrets from being exposed.

Another option is Bearer, a developer-focused SAST tool that can be easily integrated into DevSecOps pipelines. It can detect sensitive data including PII and PHI with its code analysis. Bearer doesn't store or have access to user source code, and it offers customizable rules and reporting. It supports seven programming languages and integrates with tools like Jira and Slack, giving you actionable insights to prioritize and remediate security risks.

For real-time security context, DryRun Security offers a drop-in solution that offers fast and accurate security code reviews. Using AI-powered Security Buddy, it reviews pull requests and evaluates authentication, sensitive code paths and more. DryRun Security is easy to install as a GitHub App and supports multiple programming languages, so it can help improve developer productivity.

Last, Snyk is a developer security platform that finds, prioritizes and fixes security vulnerabilities in code, dependencies and infrastructure. It offers continuous vulnerability scanning and remediation advice, and supports a broad range of tools and languages. Snyk is designed to be developer-friendly and scalable, with comprehensive controls and advanced reporting.