Secrets Scan
Detect hardcoded secrets by following the full procedure in plays/secrets-scan.md.
Steps
Run Automated Scanner — Use available tools in preference order:
trufflehog filesystem --directory=<path> --json (recommended)trufflehog git file://<repo> --json (includes git history)gitleaks detect --source=<path> --report-format=jsondetect-secrets scan <path> --all-files- If no scanner available, proceed with manual pattern analysis.
Manual Pattern Analysis — Search for high-confidence patterns:
- AWS keys (
AKIA...), OpenAI (sk-...), Anthropic (sk-ant-...), GitHub (ghp_...), Slack (xoxb-...), Stripe (sk_live_...), SendGrid (SG.)
- Connection strings with embedded passwords (
://user:pass@host)
- Private keys (PEM headers), JWT secrets, database credentials
- High-risk files:
.env, docker-compose*.yml, *.tfvars, terraform.tfstate, kubeconfig, .npmrc, .pypirc
Contextual Analysis — For each detection: Is it real (not a placeholder/test fixture)? Is it active? What's the blast radius (service, permissions, prod vs dev, exposure duration)?
Check Preventive Controls — Verify: .gitignore covers sensitive files, pre-commit hooks for secret scanning, CI pipeline scanning, secrets management documentation.
Important: Never include actual secret values in findings. Show redacted versions only (e.g., AKIA****EXAMPLE). Active production secrets require immediate rotation.
Output
Scan summary, findings using templates/finding.md, preventive controls checklist, and immediate rotation actions if needed.
OWASP References
- A07:2021: Identification and Authentication Failures
- CWE-798: Use of Hard-coded Credentials
- CWE-312: Cleartext Storage of Sensitive Information
1---2name: secrets-scan3description: Detect hardcoded credentials, API keys, tokens, and secrets in source code and configuration files. Use when reviewing code for leaked secrets before commit/merge, auditing a repository for credential exposure, or setting up secret detection.4license: CC-BY-4.05---67# Secrets Scan89Detect hardcoded secrets by following the full procedure in `plays/secrets-scan.md`.1011## Steps12131. **Run Automated Scanner** — Use available tools in preference order:14 - `trufflehog filesystem --directory=<path> --json` (recommended)15 - `trufflehog git file://<repo> --json` (includes git history)16 - `gitleaks detect --source=<path> --report-format=json`17 - `detect-secrets scan <path> --all-files`18 - If no scanner available, proceed with manual pattern analysis.19202. **Manual Pattern Analysis** — Search for high-confidence patterns:21 - AWS keys (`AKIA...`), OpenAI (`sk-...`), Anthropic (`sk-ant-...`), GitHub (`ghp_...`), Slack (`xoxb-...`), Stripe (`sk_live_...`), SendGrid (`SG.`)22 - Connection strings with embedded passwords (`://user:pass@host`)23 - Private keys (PEM headers), JWT secrets, database credentials24 - High-risk files: `.env`, `docker-compose*.yml`, `*.tfvars`, `terraform.tfstate`, `kubeconfig`, `.npmrc`, `.pypirc`25263. **Contextual Analysis** — For each detection: Is it real (not a placeholder/test fixture)? Is it active? What's the blast radius (service, permissions, prod vs dev, exposure duration)?27284. **Check Preventive Controls** — Verify: `.gitignore` covers sensitive files, pre-commit hooks for secret scanning, CI pipeline scanning, secrets management documentation.2930**Important**: Never include actual secret values in findings. Show redacted versions only (e.g., `AKIA****EXAMPLE`). Active production secrets require immediate rotation.3132## Output3334Scan summary, findings using `templates/finding.md`, preventive controls checklist, and immediate rotation actions if needed.3536## OWASP References3738- A07:2021: Identification and Authentication Failures39- CWE-798: Use of Hard-coded Credentials40- CWE-312: Cleartext Storage of Sensitive Information
OWASP