diff --git a/pkgs/development/python-modules/unidiff/default.nix b/pkgs/development/python-modules/unidiff/default.nix
new file mode 100644
index 00000000000..81e9019f489
--- /dev/null
+++ b/pkgs/development/python-modules/unidiff/default.nix
@@ -0,0 +1,21 @@
+{ lib, buildPythonPackage, fetchFromGitHub }:
+
+buildPythonPackage rec {
+  pname = "unidiff";
+  version = "0.5.5";
+
+  # PyPI tarball doesn't ship tests
+  src = fetchFromGitHub {
+    owner = "matiasb";
+    repo = "python-unidiff";
+    rev = "v${version}";
+    sha256 = "1nvi7s1nn5p7j6aql1nkn2kiadnfby98yla5m3jq8xwsx0aplwdm";
+  };
+
+  meta = with lib; {
+    description = "Unified diff python parsing/metadata extraction library";
+    homepage = https://github.com/matiasb/python-unidiff;
+    license = licenses.mit;
+    maintainers = [ maintainers.marsam ];
+  };
+}
diff --git a/pkgs/development/tools/detect-secrets/default.nix b/pkgs/development/tools/detect-secrets/default.nix
new file mode 100644
index 00000000000..c341e2eb710
--- /dev/null
+++ b/pkgs/development/tools/detect-secrets/default.nix
@@ -0,0 +1,34 @@
+{ lib, buildPythonApplication, fetchFromGitHub, isPy27, pyyaml, unidiff, configparser, enum34, future, functools32, mock, pytest }:
+
+buildPythonApplication rec {
+  pname = "detect-secrets";
+  version = "0.11.0";
+
+  # PyPI tarball doesn't ship tests
+  src = fetchFromGitHub {
+    owner = "Yelp";
+    repo = "detect-secrets";
+    rev = "v${version}";
+    sha256 = "11r11q6d8aajqqnhhz4lsa93qf1x745331kl9jd3z4y4w91l4gdz";
+  };
+
+  propagatedBuildInputs = [ pyyaml unidiff ]
+    ++ lib.optionals isPy27 [ configparser enum34 future functools32 ];
+
+  checkInputs = [ mock pytest ];
+
+  # deselect tests which require git setup
+  checkPhase = ''
+    PYTHONPATH=$PWD:$PYTHONPATH pytest \
+      --deselect tests/main_test.py::TestMain \
+      --deselect tests/pre_commit_hook_test.py::TestPreCommitHook \
+      --deselect tests/core/baseline_test.py::TestInitializeBaseline
+  '';
+
+  meta = with lib; {
+    description = "An enterprise friendly way of detecting and preventing secrets in code";
+    homepage = https://github.com/Yelp/detect-secrets;
+    license = licenses.asl20;
+    maintainers = [ maintainers.marsam ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5d7cbf38025..4a5192f900d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -700,6 +700,8 @@ in
 
   deskew = callPackage ../applications/graphics/deskew { };
 
+  detect-secrets = python3Packages.callPackage ../development/tools/detect-secrets { };
+
   diskus = callPackage ../tools/misc/diskus {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d7a22f94b53..0fa51214e43 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4382,6 +4382,8 @@ in {
 
   unicodecsv = callPackage ../development/python-modules/unicodecsv { };
 
+  unidiff = callPackage ../development/python-modules/unidiff { };
+
   unittest2 = callPackage ../development/python-modules/unittest2 { };
 
   unittest-xml-reporting = callPackage ../development/python-modules/unittest-xml-reporting { };