# Install two-ms with Homebrew

Detect secrets in files and communication platforms. Version 5.2.4 via Homebrew; verified 2026-07-26.

## Install

```sh
sudo av install brew:two-ms
```

Additional install commands:

### macOS

- Homebrew (100%):

```sh
brew install two-ms
```

  Evidence: local Homebrew formula metadata

## Package facts

- **Package key:** brew:two-ms
- **Package manager:** Homebrew
- **Version:** 5.2.4
- **Source summary:** Detect secrets in files and communication platforms
- **Homepage:** <https://github.com/Checkmarx/2ms>
- **Repository:** <https://github.com/Checkmarx/2ms>
- **Last updated:** 2026-07-26T03:12:24+02:00
- **Generated:** 2026-08-03T19:37:03+00:00

## Executables

- 2ms (alias)

## Install behavior

- Bottle: not available

## Freshness

- Page generated: 2026-08-03
- Package-manager version: 5.2.4
## Project history and usage

2ms, short for Too Many Secrets, is a Checkmarx open-source CLI for finding exposed credentials in code, files, Git history, and collaboration platforms.

### Project history

The README describes 2ms as a modern secrets-discovery CLI from Checkmarx that builds on the gitleaks detection engine with Checkmarx rules, CVSS-based scoring, reporting, and optional live validation. Its public release history visible through GitHub starts in the 2023 series and continues through frequent 2026 releases.

### Adoption history

The tool is packaged for Homebrew and also distributed through GitHub releases, source builds, and Docker. Its adoption story is therefore CI and AppSec oriented: developers install it locally with Homebrew, run it in containers, or wire SARIF/JSON output into pipelines.

### How it is used

2ms is used to scan local filesystems, Git repositories, Confluence Cloud, Slack, Discord, and Paligo. The README examples emphasize `2ms filesystem --path .` for workspace scans and `2ms git . --depth 50` for recent Git history.

### Why package nerds care

For package-manager users, 2ms is interesting because it compresses several security-scanning surfaces into one small Go CLI. It is the sort of tool installed ad hoc before publishing code, added to CI as a gate, or used during incident response to search histories and chat exports for credentials.

### Timeline

- 2023: GitHub release metadata shows early public 2.x releases.
- 2026: GitHub release metadata shows active 5.x releases and prereleases.

### Related projects

- gitleaks: the detection engine named by the 2ms README.
- Checkmarx: maintainer and vendor of the 2ms project.

### Sources

- <https://api.github.com/repos/Checkmarx/2ms/releases?per_page=100>
- <https://checkmarx.com/product/2ms/>
- <https://github.com/Checkmarx/2ms#readme>
- source_facts.package-manager


## Security Notes

narrow executable package without higher-risk signals.

- **Geiger risk:** green / low
- narrow executable package without higher-risk signals


## Combined YAML source

View the package source record on GitHub. [combined/two-ms.yml](https://github.com/mxcl/pkgdb/blob/main/combined/two-ms.yml)


## Sources

- pkg.so package database
- Geiger risk classifier
- curated package history
- pkgdb category and tag curation
- cross-ecosystem install command graph