How to detect secrets in git history with Python

import re
from pathlib import Path


def scan_history_for_secrets(history_file: str) -> list:
    """Scan a git history export for potential secrets using regex patterns."""
    patterns = {
        "AWS Access Key": r"AKIA[0-9A-Z]{16}",
        "GitHub Token": r"gh[pousr]_[0-9A-Za-z]{36,255}",
        "Private Key": r"-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----",
        "Slack Token": r"xox[baprs]-[0-9A-Za-z-]{10,}",
        "Generic API Key": r"(?i)(?:api[_-]?key|secret|token)\s*[:=]\s*['\"]?([0-9a-zA-Z\-_]{16,})",
    }

    file_path = Path(history_file)
    if not file_path.exists():
        raise FileNotFoundError(f"History file not found: {history_file}")

    findings = []
    for line_num, line in enumerate(file_path.read_text().splitlines(), 1):
        for secret_type, pattern in patterns.items():
            if re.search(pattern, line):
                findings.append(f"Line {line_num}: Potential {secret_type} found")

    return findings if findings else ["No secrets detected in history"]


if __name__ == "__main__":
    output = scan_history_for_secrets("git_history.txt")
    print("\n".join(output))