Yelp/detect-secrets is a production-grade Python library and CLI tool for detecting secrets, API keys, tokens, and other sensitive strings in source code. It operates primarily through a baseline file (`.secrets.baseline`) that records discovered secrets, enabling incremental scanning, pre-commit hook integration, and audit workflows. The tool uses a plugin-driven architecture with over 25 built-in detectors (regex-, entropy-, and keyword-based), plus configurable filters (heuristic, allowlist, word list, gibberish) to reduce false positives. Key operational flows include scanning a codebase to create or update a baseline, running as a pre-commit hook to block new secrets, and an interactive audit mode for labeling secrets as true or false positives. The architecture is modular with clear separation of concerns: plugins define detection logic, filters post-process results, settings manage global configuration, and transformers handle non-standard file formats (YAML, INI). The library also supports network verification for some secret types, automatic baseline upgrades across format versions, and custom plugin/filter injection. It is actively maintained with CI across Python 3.9-3.13 and three operating systems.