titus - High-performance secrets scanner. CLI, Go library,

项目说明

<img width="1200" height="628" alt="Titus - high-performance secrets scanner for source code, git history, and binary files" src=" />

Titus: High-Performance Secrets Scanner

![Go]()
![CI]()

Titus is a high-performance secrets scanner that detects credentials, API keys, and tokens in source code, files, and git history. It ships with 487 detection rules co hundreds of services and credential types, drawn from NoseyParker and Kingfisher. Titus runs as a CLI, a Go library, a Burp Suite extension, and a Chrome browser extension — all sharing the same detection engine and rule set.

Built for security engineers, penetration testers, and De teams, Titus combines Hyperscan/-accelerated regex matching with li to find and leaked secrets across your entire codebase.

Table of Contents

Why Titus?

Installation

Quick Start

Scanning Options

Finding Scoring

Go Library

Burp Suite Extension

Browser Extension

Building from Source

Contributing

License

Why Titus?

Fast secrets scanning: Regex matching accelerated by Hyperscan/ when a, with a pure-Go fallback for portability on any platform.

Broad credential detection co: 487 rules detect API keys, tokens, and credentials for AWS, GCP, Azure, GitHub, Slack, databases, CI/CD systems, and hundreds more services.

Li : Detected secrets are checked against their source APIs to confirm whether they are acti false positives and prioritizing remediation.

Risk-based se scoring: Every finding receives a numeric score (0–100) and se tier (info → critical). Scores are tuned by static rule metadata, code-accessibility context, and live API calls that measure the real blast radius of a credential — so the most dangerous findings always surface first.

Container image scanning: Scan Docker and OCI images directly from any registry, tarball, or OCI layout directory — no Docker daemon or binary required.

Multiple interfaces for every workflow: Scan from the CLI, embed as a Go library, passively scan HTTP traffic in Burp Suite, or scan web pages in Chrome during application security testing.

Binary file extraction: Extract and scan secrets from Office documents, PDFs, archives (zip, tar, 7z), mobile apps (APK, IPA), browser extensions, and more.

Installation

Download a prebuilt binary from the Releases page, or build from source:

The binary will be at dist/titus.

Quick Start

Results are written to a datastore (titus.ds by default) and printed to the console.

Subcommands

<!-- BEGIN generated: cli-subcommands -->
Titus organizes its functionality into these focused subcommands:

<!-- END generated: cli-subcommands -->

Every subcommand accepts --help for its own flags. The top-level titus <provider> forms that predate titus enum <provider> still work, but they are hidden and deprecated rather than aliases, so they are listed in the generated reference instead of here.

<!-- BEGIN generated: cli-aliases -->
The full reference — every subcommand, alias and flag, including the ones hidden from --help — is generated into docs/CLI.md.
<!-- END generated: cli-aliases -->

Scanning Options

GitHub & GitLab Scanning

Scan public repositories directly by URL — no API token required:

For organization-wide or user-wide scanning, use the dedicated subcommands:

Tokens are optional for public repositories. Set GITHUB_TOKEN or GITLAB_TOKEN (or use --token) for private repository access and higher API rate limits.

Docker / OCI Image Scanning

Scan container images directly — no docker daemon, no docker binary required. Titus pulls images straight from any OCI registry o (using credentials from ~/.docker/config.json), or reads images from a local docker save tarball or OCI image layout directory. It then scans image manifest/config metadata and every regular file in every layer, including lower-layer files deleted by later layers (since secrets can remain reco from image history).

Authentication uses your existing Docker / Podman config (~/.docker/config.json, ${XDG_RUNTIME_DIR}/containers/auth.json). Private registries that need a fresh login should first be authenticated with docker login (or podman login, or crane auth login) — titus does not prompt for credentials.

Scan Results

Use report to re-read findings from a previous scan:

You can also control the output format at scan time with --format:

Detected Secrets

Pass -- during a scan to check detected secrets against their source APIs:

runs concurrently (4 workers by default, configurable with --) and marks each finding as confirmed, denied, or unknown.

Filtering Detection Rules

Extracting Secrets from Binary Files

Titus can extract text from binary file formats and scan the contents for secrets:

Supported formats include Office documents (xlsx, docx, pptx, odp, ods, odt), PDFs, Jupyter notebooks, SQLite databases, email (eml, rtf), and archives (zip, tar, tar.gz, jar, war, ear, apk, ipa, crx, xpi, 7z). Archives are recursively extracted up to configurable depth and size limits.

For SQLite databases, Titus extracts text from all tables (1000 rows per table by default). Use --sqlite-row-limit to adjust:

Finding Scoring

Every finding Titus produces carries a numeric score from 0–100 and a se tier:

| Score | Se |
|-------|----------|
| 0–20 | info |
| 21–40 | low |
| 41–60 | medium |
| 61–80 | high |
| 81–100 | critical |

Scores start from the rule's base_score and are adjusted by modifiers — conditions that raise or lower the score based on what is known about the credential:

Titus ships with YAML scorers for AWS credentials, GitHub PATs, and Slack tokens, plus Go-based SDK scorers that perform live IAM policy enumeration (AWS) and repository permission checks (GitHub fine-grained PATs) when --score-scope is enabled.

See docs/scoring.md for the complete reference: se tiers, modifier kinds, built-in scorer details, and how to write your own YAML or Go scorers.

Go Library for Secrets Detection

Titus can be imported as a Go library to add secrets detection to your own tools and pipelines.

The library also supports scanning bytes and files, detected secrets, and loading custom rules:

See docs/library-usage.md for the full API reference, concurrency patterns, and more examples.

Burp Suite Extension for Secret Scanning

The Burp extension scans HTTP responses for secrets during proxy traffic and acti testing.

Setup

#### Linux / macOS (Build from Source)

Then load dist/titus-burp-1.0.0-all.jar in Burp Suite under Extensions > Add.

#### Windows (Download from Releases)

1. Download titus-windows-amd64.exe and titus-burp-<>.jar from Releases
2. Create the Titus directory and install the binary:

3. Load the JAR in Burp Suite under Extensions > Add

#### Linux / macOS (Download from Releases)

1. Download the appropriate binary for your platform and titus-burp-<>.jar from Releases:
- titus-linux-amd64 or titus-linux-arm64 for Linux
- titus-darwin-amd64 or titus-darwin-arm64 for macOS
2. Install the binary:

3. Load the JAR in Burp Suite under Extensions > Add

The extension launches a titus serve process in the background and communicates o/stdout using NDJSON. Detection rules are loaded once at startup.

Burp Extension Features

Passi scanning: automatically scans proxy traffic as it flows through Burp

Acti scanning: right-click context menu to scan selected requests

Deduplication: same secret is reported only once per engagement

Fast-path filtering: binary content, images, and non-text responses are skipped

Li : check detected secrets against source APIs to confirm if they're active

False positi: mark findings as false positives to filter noise

Se classification: findings color-coded by risk (High/Medium/Low)

Export: sa to JSON for reporting

Burp Extension Interface

The extension adds a Titus tab to Burp with three sub-tabs:

Secrets: All detected secrets with filtering by type, host, and status.

<img width="1423" height="718" alt="Titus Burp Suite extension secrets tab showing detected API keys and credentials with status" src=" />

status: Shows whether secrets have been checked (Acti/Unknown)

Filtering: Click Type, Host, or Status buttons to filter by specific ; use the search box for text and regex matching

Bulk actions: Select multiple rows to or mark as false positive in batch

Secret Details panel: Select a finding to view:

- Details: Rule info, category, full secret value, first seen timestamp
- URLs: All locations where this secret was found
- : result with details (e.g., AWS account ID, ARN)
- Request/Response: Full HTTP traffic with the secret highlighted

Statistics: Aggregate view of secrets grouped by type and host.

<img width="1964" height="848" alt="Titus Burp Suite extension statistics tab showing secrets by type and host" src=" />

Summary: Total unique secrets, hosts scanned, breakdown (active ), and false positi

Secrets by Type: Count of each secret type with category classification

Secrets by Host: Number of secrets found per host

Settings: Configure scanning options, , and se mappings.

<img width="2164" height="1192" alt="Titus Burp Suite extension settings tab with scan configuration options" src=" />

Scan Settings:

- *Passi*: Automatically scan all proxy traffic (enabled by default)
- *Request body scanning*: Also scan request bodies for secrets sent by the application
- **: Enable to check secrets against source APIs (makes outbound requests and may trigger alerts)

Scan Parameters: Worker threads, max file size, context snippet length

Se Configuration: Customize se levels per secret category

Actions: Clear cache, reset settings, sa findings to JSON

When any request in Burp, a Titus tab appears in the response inspector if secrets are detected, pro quick access to findings without switching to the main Titus tab.

<img width="2658" height="946" alt="Titus tab in Burp Suite response inspector highlighting detected secrets in HTTP responses" src=" />

Chrome Browser Extension for Secret Scanning

The Chrome extension scans web pages for secrets during web application security assessments.

Setup

1. Na to chrome://extensions/
2. Enable De mode
3. Click Load unpacked and select the extension/ directory

Browser Extension Features

Scans inline and external Ja and stylesheets for API keys and tokens

Scans localStorage and sessionStorage for leaked credentials

Optional network response capture for comprehensi detection

Results displayed in popup and dashboard

<img width="1719" height="958" alt="Titus Chrome extension popup showing detected secrets on a web page" src=" />

<img width="1744" height="827" alt="Titus Chrome extension dashboard with aggregated secret detection results" src=" />

Security Notice

The browser extension remo Security Policy and CORS headers from pages to scan external resources. This weakens the security posture of sites you visit while the extension is active. Only enable during acti testing.

Building from Source

Standard Build ()

By default Titus compiles with (ARM) / Hyperscan (x86) for SIMD-accelerated regex matching. This needs CGO, the C library, and pkg-config (which cgo uses to locate the library). make build checks for these and attempts to install anything missing / apt / dnf:

You'll see [] N/N rules compiled for Hyperscan on startup when the accelerated engine is active.

To install the C library yourself instead of relying on auto-install:

If you invoke go build directly (for example, when embedding Titus), pass the tag and enable CGO:

Pure-Go Build (no C dependencies)

If you can't install the C library — or want a fully portable, static binary — build the pure-Go engine instead. Titus automatically falls back to it at runtime whene isn't compiled in:

#### Automatic Hyperscan database cache

Titus automatically serializes each successfully compiled Hyperscan database
to the standard user cache. Later scanner instances with the exact same ordered
rules and flags load that database instead of compiling it again. The cache file
is the unmodified byte stream produced by Hyperscan's hs_serialize_database,
and Titus loads it with hs_deserialize_database.

TITUS_CACHE_DIR can o the cache location. Cache writes are atomic and
best-effort: an una or read-only cache does not prevent scanning. A
missing, corrupt, incompatible, or differently fingerprinted database triggers
normal compilation and refreshes the cache when possible.

Serialized databases are architecture-, CPU-feature-, and Hyperscan-
specific. Titus detects incompatible entries while deserializing and replaces
them with a database compiled for the current runtime.

Contributing

Contributions are welcome! See CONTRIBUTING.md for guidelines on how to contribute to Titus.

License

Apache License 2.0 — see LICENSE.

Detection rules are derived from NoseyParker (Praetorian Security, Inc.) and Kingfisher (MongoDB, Inc.), both licensed under Apache 2.0. See NOTICE for full attribution.

项目信息

开发语言：Go

Star 数：707

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕High-performance secrets scanner. CLI, Go library, Burp Suite extension, and Chrome extension. 487 detection rules with live credential validation.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。