What is credshound?

CredsHound is a command-line tool written in Go that scans a computer for exposed or forgotten credentials such as API keys, session tokens, and configuration secrets. It works similarly to security scanners like Nuclei, using a library of known patterns to recognize what a leaked credential from a particular service looks like, so it is not only looking for generic-looking strings. It checks a wide range of places: environment variables, process environments on Linux, configuration files, Git credential files, Docker and Kubernetes config, shell history files, private keys, and database tool configs such as DBeaver. It also pays specific attention to newer AI-related setups, including configuration for AI coding assistants and AI agent tools, since these often store API keys for services like OpenAI or Hugging Face. When run inside WSL, the Windows Subsystem for Linux, it can additionally read Windows-style profile paths so a single scan covers both Linux and Windows-style artifacts on the same machine. A standout feature is integration with BloodHound, a tool security professionals use to visualize attack paths inside a network. CredsHound can export its findings as graph data that, once imported into BloodHound, shows exactly which credentials trace back to which hosts and services, making it easier to understand the impact of a single compromised machine. The tool is installed with Go, either through go install or by building it locally, and it downloads its detection templates from a separate companion project. It offers filtering by severity, credential type, or source, and can write results as JSONL files or BloodHound-ready JSON. Findings are redacted by default so plaintext secrets are not shown unless explicitly requested. The README states this tool is meant for auditing systems you own or are authorized to test, and that scan output should be treated as confidential since it can expose real secrets.