Home

Prowl

Prowl is a fast, configurable secret scanner. It reads a codebase, git history, a live web page, or a stream of text and reports leaked credentials — API keys, tokens, database URIs, private keys, passwords in prose — with the line, column, and a confidence score. The design goal is high recall without a flood of false positives.

This wiki documents every feature, command, and flag.

Quick start

go install github.com/Lercas/prowl/tool/cmd/prowl@latest
prowl rules update          # install the detection library into ~/.prowl
prowl scan .                # scan the working tree

$ prowl scan .

  src/config/prod.ts
    ✖ critical  aws_access_key_id      42:18   AKIA••••DSYP    live
  .env.example
    ✖ high      github_pat             3:11    ghp_••••a1b2

  2 findings  1 critical · 1 high  in 2 files

Pages

Getting started

• Installation — Go, Docker, binary, source; first-run setup
• Quick Start — the common workflows, copy-paste

Scanning

• Scanning Files — prowl scan, git modes, every flag
• Repository Scanning — clone & scan a remote repo by URL
• Org-Wide Scanning — clone & scan every repo in an org/group/workspace
• Container Scanning — pull & scan an OCI/Docker image
• Cloud Storage Scanning — download & scan an S3 / GCS prefix
• Domain Scanning — prowl domain, authorized web recon
• Jira & Confluence Scanning — every issue/page version, Cloud & Server/DC
• Live Verification — --verify, confirming a secret is live

Detection

• Rules — the nuclei-style template library and authoring loop
• Verifiers — data-driven live-credential verifiers
• Architecture — the three-stage detection cascade
• Data Flywheel — the self-improving ML false-positive filter and its retrain loop

Integrate

• CI/CD Integration — exit codes, SARIF, baselines, pre-commit
• Server Mode — prowl serve, the HTTP scan API
• Editor Integration (LSP) — in-editor highlighting

Reference

• Configuration — .prowl.yaml fields, pragmas, environment variables
• Output Formats — pretty, JSON, SARIF
• Security Model — how Prowl avoids becoming an attack surface
• Doctor & Troubleshooting — prowl doctor and common issues

Project

• Source — https://github.com/Lercas/prowl
• Detection library — https://github.com/Lercas/prowl-templates
• Benchmark — https://github.com/Lercas/prowlbench
• License — PolyForm Noncommercial 1.0.0 (free for non-commercial use)