Navinspire-ia Secrets Scanner
Overview
Find secrets that should never be in the repository, ranked by how exploitable the leak is. A committed live production key is critical; a placeholder in an example file is informational. Every finding cites file, line, and the secret type (never echo the full secret value - show a masked prefix only).
What to detect
| Class | Signals |
|---|---|
| Cloud keys | AKIA… (AWS), AIza… (Google), Azure connection strings, GCP service-account JSON |
| Tokens | GitHub ghp_/gho_, Slack xox…, Stripe sk_live_, JWT secrets, bearer tokens |
| Private keys | `-----BEGIN (RSA |
| Passwords | password=, passwd, basic-auth in URLs, DB connection strings with creds |
| Generic | high-entropy strings assigned to secret/token/apikey/key names |
Workflow
- Call
security_scan(kind=secrets)first for structured baseline findings. - Scan the working tree deeply: source, config,
.env*, CI files, Dockerfiles, notebooks, and infra manifests. - Then scan git history (
git log -p,git rev-list) - a secret removed in a later commit is still exposed and must be rotated. - Prefer real tooling when present (
gitleaks,trufflehog,detect-secrets); use pattern sweeps for what they miss. - Triage false positives: test fixtures, obvious placeholders (
xxx,changeme,example), and public keys are not leaks - mark them Info. - For each real finding, mask the value (
sk_live_51H…→sk_live_51H•••), and give the response: rotate the credential, remove from history if committed, and move to a secret manager / env var. - Recommend prevention:
.gitignorerules, pre-commit secret scanning, and a secrets baseline.
Anti-patterns
- Printing the full secret in the report (mask it)
- Flagging placeholders and test fixtures as critical leaks
- Assuming deletion from the current tree is enough (history still leaks; rotation is mandatory)
- Rotating or editing anything without an explicit request