Security Auditor
Repository security audit for sensitive information detection.
Detection Targets
| Type |
Pattern Examples |
| API Keys |
sk-, AKIA, ghp_, xoxb- |
| Passwords |
PASSWORD=, password:, hardcoded strings |
| Private Keys |
Generic, encrypted, RSA, OpenSSH, EC, DSA, and PGP armor headers |
| User Paths |
/Users/realname/, /home/realname/ |
| DB Strings |
mongodb://, postgres:// with credentials |
Coverage and Redaction Guarantees
- Scan both Git index blobs and tracked worktree text, regardless of extension or
path. Documentation, tests, examples, fixtures, templates, and
placeholder-bearing lines stay in scope.
- Skip only content Git identifies as binary; do not use content-based record
exclusions.
- Never print the matched line or historical diff. Report only path, line,
detector ID, severity, commit metadata when applicable, and an occurrence
number. Finding identity never derives from matched content.
- Deduplicate identical detector and location metadata across the index and
worktree representations.
- Do not cap findings. History reports how many reachable commit snapshots were
scanned and whether the requested commit limit truncated snapshot coverage.
Workflow
Step 1: Run the Auditor
# Current Git index blobs, tracked worktree text, and sensitive filenames
scripts/security-audit.sh quick
# Current text, all reachable commit snapshots, deleted paths, and .gitignore
scripts/security-audit.sh scan
Run from the repository being audited. A sensitive file that exists only locally
is outside the tracked-file scan; a tracked sensitive filename is a finding.
Step 2: Select History Depth When Needed
# Scan the last 250 reachable commit snapshots.
# The report states whether this truncates snapshot coverage.
scripts/security-audit.sh history 250
# Explicitly scan every reachable commit snapshot
scripts/security-audit.sh history all
Deleted sensitive paths are checked across all reachable commits even when the
snapshot limit is smaller.
Step 3: Interpret the Exit Status
0: scan completed with no findings1: scan completed and reported one or more findings2: usage or operational error
Step 4: Verify .gitignore
scripts/security-audit.sh gitignore
Report Format
## Security Audit Report
### Finding
- path=src/config line=12 detector=hardcoded-api-key occurrence=1 severity=HIGH
### History finding
- commit=<abbreviated-commit> path=docs/setup line=8 detector=hardcoded-password occurrence=1 severity=CRITICAL
### ✅ Passed
- Finding cap: none; all matches are reported
- Snapshot coverage: 42 of 42 reachable commits; truncated: no
Difference from git-commit-pr
| Skill |
Scope |
When |
git-commit-pr |
Changed files only |
At commit time |
security-auditor |
Entire repo + history |
Periodic audit |
1---2name: security-auditor3description: Audits repository security by analyzing current code and commit history for sensitive information leaks. Detects API keys, passwords, and credentials. Use for "보안 점검", "보안 감사", "security audit", "민감 정보 검사" requests.4---56# Security Auditor78Repository security audit for sensitive information detection.910## Detection Targets1112| Type | Pattern Examples |13|------|------------------|14| API Keys | `sk-`, `AKIA`, `ghp_`, `xoxb-` |15| Passwords | `PASSWORD=`, `password:`, hardcoded strings |16| Private Keys | Generic, encrypted, RSA, OpenSSH, EC, DSA, and PGP armor headers |17| User Paths | `/Users/realname/`, `/home/realname/` |18| DB Strings | `mongodb://`, `postgres://` with credentials |1920## Coverage and Redaction Guarantees2122- Scan both Git index blobs and tracked worktree text, regardless of extension or23 path. Documentation, tests, examples, fixtures, templates, and24 placeholder-bearing lines stay in scope.25- Skip only content Git identifies as binary; do not use content-based record26 exclusions.27- Never print the matched line or historical diff. Report only path, line,28 detector ID, severity, commit metadata when applicable, and an occurrence29 number. Finding identity never derives from matched content.30- Deduplicate identical detector and location metadata across the index and31 worktree representations.32- Do not cap findings. History reports how many reachable commit snapshots were33 scanned and whether the requested commit limit truncated snapshot coverage.3435## Workflow3637### Step 1: Run the Auditor3839```bash40# Current Git index blobs, tracked worktree text, and sensitive filenames41scripts/security-audit.sh quick4243# Current text, all reachable commit snapshots, deleted paths, and .gitignore44scripts/security-audit.sh scan45```4647Run from the repository being audited. A sensitive file that exists only locally48is outside the tracked-file scan; a tracked sensitive filename is a finding.4950### Step 2: Select History Depth When Needed5152```bash53# Scan the last 250 reachable commit snapshots.54# The report states whether this truncates snapshot coverage.55scripts/security-audit.sh history 2505657# Explicitly scan every reachable commit snapshot58scripts/security-audit.sh history all59```6061Deleted sensitive paths are checked across all reachable commits even when the62snapshot limit is smaller.6364### Step 3: Interpret the Exit Status6566- `0`: scan completed with no findings67- `1`: scan completed and reported one or more findings68- `2`: usage or operational error6970### Step 4: Verify .gitignore7172```bash73scripts/security-audit.sh gitignore74```7576## Report Format7778```markdown79## Security Audit Report8081### Finding82- path=src/config line=12 detector=hardcoded-api-key occurrence=1 severity=HIGH8384### History finding85- commit=<abbreviated-commit> path=docs/setup line=8 detector=hardcoded-password occurrence=1 severity=CRITICAL8687### ✅ Passed88- Finding cap: none; all matches are reported89- Snapshot coverage: 42 of 42 reachable commits; truncated: no90```9192## Difference from git-commit-pr9394| Skill | Scope | When |95|-------|-------|------|96| `git-commit-pr` | Changed files only | At commit time |97| `security-auditor` | Entire repo + history | Periodic audit |
jiunbae