Intercept, detect, and redact sensitive credentials in real-time within your infrastructure. A production-grade, zero-dependency sidecar engine clocking 30,000+ lines per second.
Real-world execution results from a 50,000-line stress test with Shannon Entropy fully enabled. Not synthetic. Not theoretical. Measured on production-class hardware.
Python's GIL makes threading counterproductive for CPU-bound regex work. Here's why OpSecGuard's architecture is fundamentally faster.
def endpoint keeps event loop free
async def blocks the event loop on CPU work
Purpose-built for DevSecOps teams who can't afford credential leaks reaching Datadog, Splunk, or CloudWatch.
Zero per-request compilation cost. All 10+ detector patterns are compiled at process startup and run native C-level
loops via Python's re module. Bounded quantifiers prevent ReDoS attacks.
Smart group-capture parsing that isolates only the password component in MongoDB and PostgreSQL URIs, while keeping host, port, and connection parameters visible for debugging.
Optional Shannon Entropy scanning to catch non-deterministic randomized tokens and high-entropy
secret strings that evade deterministic regex patterns. Gated by ENABLE_ENTROPY flag.
Standard synchronous def endpoint handling designed to pass heavy CPU lifting smoothly into
FastAPI's external thread pool, keeping the main event loop entirely free for concurrent connections.
From zero to scanning in under 60 seconds. No config files, no build steps, no dependencies.
docker run -d -p 8000:8000 -e ENABLE_ENTROPY=True csfasih/opsecguard-apiSingle Docker command pulls the image and starts the scanner on port 8000.
Route your application logs to POST /v1/scan/batch or connect via WebSocket at /v1/scan/stream.
Forward the sanitized output to Datadog, Splunk, or CloudWatch — zero secrets leaked.