macOS
Homebrewverified · 100%
brew install two-mslocal Homebrew formula metadata
brew / rank 5277
Install two-ms with Homebrew
Detect secrets in files and communication platforms. Version 5.2.4 via Homebrew; verified 2026-07-26.
install
Additional install commands
overview
Package summary
Detect secrets in files and communication platforms
Project links
Commands and aliases
- 2ms
history
Project history and usage
2ms, short for Too Many Secrets, is a Checkmarx open-source CLI for finding exposed credentials in code, files, Git history, and collaboration platforms.
Project history
The README describes 2ms as a modern secrets-discovery CLI from Checkmarx that builds on the gitleaks detection engine with Checkmarx rules, CVSS-based scoring, reporting, and optional live validation. Its public release history visible through GitHub starts in the 2023 series and continues through frequent 2026 releases.
Adoption history
The tool is packaged for Homebrew and also distributed through GitHub releases, source builds, and Docker. Its adoption story is therefore CI and AppSec oriented: developers install it locally with Homebrew, run it in containers, or wire SARIF/JSON output into pipelines.
How it is used
2ms is used to scan local filesystems, Git repositories, Confluence Cloud, Slack, Discord, and Paligo. The README examples emphasize `2ms filesystem --path .` for workspace scans and `2ms git . --depth 50` for recent Git history.
Why package nerds care
For package-manager users, 2ms is interesting because it compresses several security-scanning surfaces into one small Go CLI. It is the sort of tool installed ad hoc before publishing code, added to CI as a gate, or used during incident response to search histories and chat exports for credentials.
Timeline
- 2023: GitHub release metadata shows early public 2.x releases.
- 2026: GitHub release metadata shows active 5.x releases and prereleases.
Related projects
- gitleaks: the detection engine named by the 2ms README.
- Checkmarx: maintainer and vendor of the 2ms project.
Sources
security posture
Risk level: green
narrow executable package without higher-risk signals.
Risk classifier
green risk · low confidence · appliance
Why
- narrow executable package without higher-risk signals
Signals
- metadata:no-higher-risk-signals
Install behavior
- No Homebrew bottle metadata was recorded.
Recommended review
Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.
executables
Installed executables
| Command | Kind | Exposure | Note |
|---|---|---|---|
2ms | executable | indexed executable | Discovered from the local executable index. |
freshness
Version and freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
page generated2026-08-03
manager version5.2.4
manager updated2026-07-26
local dataunknown
upstreamnot available
latest detectednot detected
- okNo freshness warnings were generated.
install metadata
Package metadata
| Package key | brew:two-ms |
|---|---|
| Version | 5.2.4 |
| Package manager | Homebrew |
| Homepage | https://github.com/Checkmarx/2ms |
| Repository | https://github.com/Checkmarx/2ms |
| Last updated | 2026-07-26T03:12:24+02:00 |
| Pulse | updated |
| Bottle | not recorded |
| Service | none declared |
source trail
Generated from repository data
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
Combined YAML source
View the package source record on GitHub.
Used sources
- Geiger risk classifier
- cross-ecosystem install command graph
- curated package history
- pkg.so package database
- pkgdb category and tag curation