changelog

Every change, documented.

Keep a Changelog format · semantic versioning · raw on GitHub

unreleased

planned next

Silent redaction via updatedToolOutput for PostToolUse hooks — the agent never sees the raw value.
Active verification mode — "is this key actually live?"
--file-path flag on scan --stdin for path-based allowlists.

v0.1.02026-10-15

Initial release — live on PyPI and the Claude Code plugin marketplace.
Detection core: 48 regex rules covering 51 providers, bash escape-hatch detector, entropy candidates.
Provider coverage: 11 dev/infra (Z.ai, Anthropic, OpenAI, GitHub, GitLab, Figma, PyPI, npm, Linear, Stripe, Slack) + 34 LLM inference providers (OpenRouter, Groq, Together, Fireworks, xAI, Perplexity, Hugging Face, Cerebras, Replicate, Vercel AI Gateway, NVIDIA NIM, Chutes, Requesty, Novita, Upstage, Baseten, Baidu Qianfan, fal.ai, DashScope, Moonshot Kimi, Mistral, Cohere, Scaleway, SambaNova, Nebius, AI21, OVHcloud, FriendliAI, GMI Cloud, Crusoe, Featherless, DeepInfra, Inference.net, BytePlus) + generic fallbacks for bare-sk- (DeepSeek, StepFun, SiliconFlow, Poe, Qwen) and JWT shapes (MiniMax).
Providers with no publicly documented key format get keyword-gated opaque rules — attribution + rotation URL, not shape confidence. No guessed regexes, ever.
OpenAI rule tightened to the T3BlbkFJ marker — no double-fire with the generic sk- rule.
Claude Code plugin with 6 hook scripts covering 8 detection rows.
CLI peer with scan, list, close, watch commands.
Pattern layering: builtin → ~/.token-hunt/patterns.local.toml → ./.token-hunt/patterns.local.toml.
Allowlist engine (path-based + fingerprint-based).
rotations.log JSONL store with 72-hour OVERDUE tracking.
Bash escape-hatch detection — the ${VAR:+SET}${VAR:-UNSET} bug class no regex scanner sees.
TOKEN_HUNT_DISABLE=1 opt-out · TOKEN_HUNT_ALLOW=1 one-shot bypass.
Fail-closed: scanner crashes BLOCK with a bypass hint, never silently allow.

← back to tokenhunt.dev