# Code Review Secrets Detection

> Find leaked secrets in code, git history, and CI. Load on "secrets", "leaked key", a repo/ git history in scope, exposed .git, CI config review, or public-repo OSINT. Signals: API keys, tokens, .env files, private keys, cloud creds, hardcoded passwords.

- Skill: `noorqureshi/code-review-secrets-detection` (Agent Skill)
- Install (CLI): `npx skillmds@latest add noorqureshi/code-review-secrets-detection`
- Raw SKILL.md: https://api.skillmd.com/api/skills/noorqureshi/code-review-secrets-detection/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: NoorQureshi (https://skillmd.com/u/noorqureshi)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/noorqureshi/code-review-secrets-detection

---


# Secrets detection

## When it applies
Any source you can read: an in-scope repo, an exposed `.git/` on a web server, public GitHub
repos of the org, or CI/CD config. Live secrets are direct, high-impact findings.

## Why it works
Secrets get committed and then "removed" — but git keeps history, so they persist in old
commits, branches, and stashes. Config/CI files and client bundles also embed keys that ship to users.

## Method
1. **Scan history, not just HEAD**: `trufflehog git file://. --only-verified` or
   `gitleaks detect --source . -v` — these walk every commit and (trufflehog) verify keys live.
2. **Exposed .git on a target**: `git-dumper http://target/.git/ out/` then scan the recovered repo.
3. **Org-wide OSINT**: GitHub dorks / `trufflehog github --org=<org>` for public leaks (in scope only).
4. **Client-side & config**: grep JS bundles, mobile apps, `.env`, Dockerfiles, k8s manifests,
   CI YAML for keys and tokens.
5. **Validate & scope impact**: confirm the key works with a read-only call (e.g.
   `aws sts get-caller-identity`) — a live, privileged key is the report; a dead one is informational.

## Gotchas
- Report *verified/live* secrets; example/placeholder keys inflate severity and get closed as N/A.
- Rotate-awareness: note it may be live now; don't exfiltrate data with it — prove access, stop.
- Deleted-from-HEAD ≠ gone — always scan full history.

## Verify success
A secret that authenticates successfully (minimal proof), with where it lives (commit/file) —
don't paste the secret value into reports, reference its location.

## References
trufflehog & gitleaks docs; GitHub secret-scanning; OWASP secrets management.