# Secrets Scan

> Scan project changes for leaked secrets, credentials, unsafe env handling, and accidental private data. This is the DETECTION pass over what is already in the tree; `secrets-discipline` is the preventive workflow that stops it happening. Run before every commit, before every release (invoked by `release-check`), and when the user says "vazou alguma chave aí?", "isso tá seguro pra subir?", "esqueci alguma senha no código?".

- Skill: `lglucas/secrets-scan` (Agent Skill)
- Install (CLI): `npx skillmds@latest add lglucas/secrets-scan`
- Raw SKILL.md: https://api.skillmd.com/api/skills/lglucas/secrets-scan/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Productivity
- Author: lglucas (https://skillmd.com/u/lglucas)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/lglucas/secrets-scan

---


# Secrets Scan

## Checklist

- No `.env` committed.
- `.env.example` contains placeholders only.
- No API keys, tokens, private keys, cookies, or production credentials in code/docs/prompts.
- No logs exposing secrets or personal data.
- CI/CD secrets are referenced by environment name, not literal value.