# Secret Exposure Prevention

> Prevent secret leakage across git history, package artifacts, logs, and docs. Use when editing workflows, packaging configuration, environment files, or release automation.

- Skill: `gabrielmoreira/secret-exposure-prevention` (Agent Skill)
- Install (CLI): `npx skillmds@latest add gabrielmoreira/secret-exposure-prevention`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gabrielmoreira/secret-exposure-prevention/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: gabrielmoreira (https://skillmd.com/u/gabrielmoreira)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/gabrielmoreira/secret-exposure-prevention

---


# Secret Exposure Prevention

## When to use

- On changes involving `.env`, publish scripts, workflow files, and package include/exclude rules.
- Before packaging/publishing distributable artifacts.
- After any secret-handling incident or near-miss.

## Procedure

1. Identify secret-bearing file patterns in repo and tooling context.
2. Verify packaging exclude rules (`.vscodeignore`, `.npmignore`, artifact manifests).
3. Verify prevention controls (pre-commit scanning, CI scanning, secret scanning backstops).
4. Validate that examples and docs use placeholders, never live tokens.
5. Propose targeted guardrails with minimal operational overhead.

## Output format

- `risk_status`: low|medium|high
- `exposure_surfaces`: git|artifact|logs|docs
- `missing_controls`: specific missing guardrails
- `recommended_controls`: prevention-first controls in priority order
- `evidence`: files, workflows, and policies reviewed

## Standards

- Prevention first, detection second.
- Never accept shipping secret-bearing files in distributable artifacts.
- Keep false-positive handling explicit and auditable.