Secrets Management Audit (FIND/FIX — credentials & keys)
Overview
Leaked secrets are among the fastest paths to compromise — one committed key can hand over a whole
cloud account. This skill finds exposed secrets everywhere they hide and audits whether the app
manages them properly (vaulted, rotated, scoped).
Core principle: A secret in source/history/logs/binary is already public — assume
compromised and rotate. Detection without rotation is theater.
Applies when / Skip when
- Applies when: essentially always — every app has secrets/keys/config somewhere (source,
git history, logs, env, build artifacts, CI).
- Skip when: effectively never. Even a static site has API keys, deploy creds, or CI tokens.
- If genuinely nothing to scan: say so explicitly — but verify first; "no secrets" is almost
always "didn't look hard enough."
⚠️ Authorization
Your own/authorized repos, artifacts, and infrastructure. If you find a real exposed secret,
treat it as an incident: rotate first, then fix the leak path.
Where secrets hide (hunt all of these)
| Location |
How |
| Source code |
Scanners + grep for key patterns |
| Git history |
Secrets deleted from HEAD still live in history — scan all commits |
| Frontend bundles |
JS/source maps shipping keys to the browser |
| Mobile binaries |
Decompiled APK/IPA (apktool/jadx, strings) |
| Logs & error output |
Tokens/PII printed to stdout/log files/APM |
| Config & env |
.env, config files, container env, cloud user-data |
| CI/CD |
Pipeline files, build logs, masked-but-leaked env vars |
| Cloud |
Instance metadata, function env, IaC state, config |
See references/secret-hunting.md for tooling and patterns.
Method
- Scan broadly — full git history + working tree + artifacts + logs with entropy + pattern detectors.
- Validate — is the hit a live credential? (don't use third-party creds; verify benignly/own-keys only)
- Assess blast radius — what does the secret unlock? scope/permissions?
- Manage audit — are secrets vaulted, rotated, least-privilege, not in code?
- Remediate — rotate exposed secrets, purge from history, move to a manager, add prevention.
Tooling
trufflehog, gitleaks, detect-secrets (detection incl. history & entropy); git filter-repo/
BFG (purge history); cloud secret managers / Vault (storage); pre-commit hooks + CI scanning (prevent).
Output
Per finding: secret type, location (incl. commit hash), validity, blast radius, and rotation status.
Live high-privilege keys are Critical — rotate immediately.
Hand-off
Chains (leaked key → account/cloud takeover) → vulnerability-chaining; fix & prevention →
security-hardening (rotate, vault, scope, pre-commit/CI secret scanning).
Common mistakes
- Scanning only HEAD — git history is where deleted secrets live forever.
- Removing a secret from code but not rotating it — it's already compromised.
- Shipping "public" keys that are actually secret/service keys in frontend/mobile bundles.
- No prevention — without pre-commit/CI scanning, the next secret lands next week.
1---2name: secrets-management-audit3description: Use when hunting for exposed secrets and auditing how an app you own manages them — API keys, tokens, passwords, and private keys in source, git history, binaries, logs, config, and CI; plus vaulting, rotation, and least-privilege of the secrets themselves.4---56# Secrets Management Audit (FIND/FIX — credentials & keys)78## Overview9Leaked secrets are among the fastest paths to compromise — one committed key can hand over a whole10cloud account. This skill finds exposed secrets everywhere they hide and audits whether the app11manages them properly (vaulted, rotated, scoped).1213**Core principle:** A secret in source/history/logs/binary is **already public** — assume14compromised and rotate. Detection without rotation is theater.1516## Applies when / Skip when17- **Applies when:** essentially always — every app has secrets/keys/config somewhere (source,18 git history, logs, env, build artifacts, CI).19- **Skip when:** effectively never. Even a static site has API keys, deploy creds, or CI tokens.20- **If genuinely nothing to scan:** say so explicitly — but verify first; "no secrets" is almost21 always "didn't look hard enough."2223## ⚠️ Authorization24Your own/authorized repos, artifacts, and infrastructure. If you find a real exposed secret,25treat it as an incident: rotate first, then fix the leak path.2627## Where secrets hide (hunt all of these)28| Location | How |29|----------|-----|30| Source code | Scanners + grep for key patterns |31| **Git history** | Secrets deleted from HEAD still live in history — scan all commits |32| Frontend bundles | JS/source maps shipping keys to the browser |33| Mobile binaries | Decompiled APK/IPA (`apktool`/`jadx`, `strings`) |34| Logs & error output | Tokens/PII printed to stdout/log files/APM |35| Config & env | `.env`, config files, container env, cloud user-data |36| CI/CD | Pipeline files, build logs, masked-but-leaked env vars |37| Cloud | Instance metadata, function env, IaC state, config |3839See `references/secret-hunting.md` for tooling and patterns.4041## Method421. **Scan broadly** — full git history + working tree + artifacts + logs with entropy + pattern detectors.432. **Validate** — is the hit a live credential? (don't *use* third-party creds; verify benignly/own-keys only)443. **Assess blast radius** — what does the secret unlock? scope/permissions?454. **Manage audit** — are secrets vaulted, rotated, least-privilege, not in code?465. **Remediate** — rotate exposed secrets, purge from history, move to a manager, add prevention.4748## Tooling49`trufflehog`, `gitleaks`, `detect-secrets` (detection incl. history & entropy); `git filter-repo`/50BFG (purge history); cloud secret managers / Vault (storage); pre-commit hooks + CI scanning (prevent).5152## Output53Per finding: secret type, location (incl. commit hash), validity, blast radius, and rotation status.54Live high-privilege keys are Critical — rotate immediately.5556## Hand-off57Chains (leaked key → account/cloud takeover) → `vulnerability-chaining`; fix & prevention →58`security-hardening` (rotate, vault, scope, pre-commit/CI secret scanning).5960## Common mistakes61- Scanning only HEAD — **git history** is where deleted secrets live forever.62- Removing a secret from code but **not rotating** it — it's already compromised.63- Shipping "public" keys that are actually secret/service keys in frontend/mobile bundles.64- No prevention — without pre-commit/CI scanning, the next secret lands next week.
mn-youssef