How hanchuntao/keyhound works
KeyHound is a local-first Git secret scanner. A user submits a repository or Docker image through the CLI; the tool gathers source and history, detects and filters candidate secrets, optionally pairs and verifies findings, then presents or exports results. Its documented scope also includes Kubernetes/Helm, CI logs, and multiple SaaS/cloud credential families. The graph captures the principal flow and major capabilities; several specialized scanners and report paths are represented at directory or module level because their implementations were not excerpted.
Main entry points: cli.py CLI workflow · rule_engine.py Rule engine · cloud_sign.py Cloud signatures · git_traversal.py Git history
Components 21
Input and orchestration
- CLI workflow
keyhound/cli.py - Git history
keyhound/scanner/git_traversal.py - Docker scans
keyhound/docker_scan.py - Scan config
keyhound/config.py
Detection and analysis
- Rule engine
keyhound/scanner/rule_engine.py - Noise filters
keyhound/scanner/filters.py - Entropy analysis
keyhound/utils/entropy.py - Finding model
keyhound/scanner/finding.py - Credential pairing
keyhound/scanner/association.py - Specialized scans
keyhound/scanner - Archive scans
keyhound/scanner/archive_scan.py
Validation and review
- SaaS verification
keyhound/verify.py - Cloud signatures
keyhound/scanner/cloud_sign.py - AI review
keyhound/ai_review.py
Results and learning
- HTML report
keyhound/report/html_report.py - CI report formats
keyhound - Learning library
keyhound/learn.py
Other components
- Engineer
- Cloud provider APIs
- SaaS endpoints
- AI service
Connections 22
- Engineer → CLI workflow: runs scan
README.md - CLI workflow → Scan config: loads settings
keyhound/cli.py - CLI workflow → Git history: scans history
keyhound/cli.py - CLI workflow → Docker scans: scans image
keyhound/cli.py - CLI workflow → Rule engine: scans content
keyhound/cli.py - Git history → Archive scans: scans archives
keyhound/scanner/git_traversal.py - Rule engine → Finding model: creates findings
keyhound/scanner/rule_engine.py - Rule engine → Entropy analysis: checks entropy
keyhound/scanner/rule_engine.py - Rule engine → Noise filters: filters matches
README.md - Rule engine → Specialized scans: detects formats
README.md - CLI workflow → Credential pairing: pairs findings
keyhound/cli.py - Credential pairing → Cloud signatures: checks key pairs
keyhound/scanner/association.py - CLI workflow → SaaS verification: verifies findings
keyhound/cli.py - SaaS verification → SaaS endpoints: sends requests
keyhound/verify.py - CLI workflow → Cloud signatures: verifies cloud keys
README.md - Cloud signatures → Cloud provider APIs: signs requests
keyhound/scanner/cloud_sign.py - CLI workflow → AI review: reviews findings
keyhound/cli.py - AI review → AI service: requests review
keyhound/ai_review.py - CLI workflow → HTML report: writes HTML
keyhound/cli.py - CLI workflow → CI report formats: exports reports
README.md - CLI workflow → Learning library: records findings
README.md - Learning library → Finding model: summarizes findings
keyhound/learn.py