# Secrets Leak Detector

> Scan codebases to detect leaked API keys, tokens, or credentials.

- Skill: `rmazrim/secrets-leak-detector` (Agent Skill)
- Install (CLI): `npx skillmds@latest add rmazrim/secrets-leak-detector`
- Raw SKILL.md: https://api.skillmd.com/api/skills/rmazrim/secrets-leak-detector/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: RMAzrim (https://skillmd.com/u/rmazrim)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/rmazrim/secrets-leak-detector

---


# Secrets Leak Detector

## Prerequisites & Dependencies
- `gitleaks` 8.x and/or `trufflehog` 3.x on `PATH`; Git access to the full repository history
- Optional: `pre-commit` (Python) for local hook-based scanning
- Incident response access: authority to revoke/rotate credentials for any confirmed finding

## Execution Steps
1. Run a no-git scan on the working tree to catch unstaged leaks: `gitleaks detect --no-git -v`.
2. Scan the entire Git history, including deleted branches: `gitleaks detect --log-opts="--all"` (optionally `--redact` on shared terminals).
3. Cross-check with Trufflehog verification to reduce false positives: `trufflehog git file://. --only-verified`.
4. Triage findings: classify valid vs revoked, record commit hash, author, and file path; never paste secret values into tickets or reports.
5. Rotate every exposed credential immediately — treat all detected secrets as compromised regardless of age.
6. Purge secrets from history with `git filter-repo` (force-push with team coordination), then add a pre-commit scan and a `.gitleaks.toml` allowlist for sanctioned test fixtures.

```bash
gitleaks detect --no-git --verbose --report-format json --report-path leaks.json
gitleaks detect --log-opts="--all" --verbose --redact
trufflehog git file://. --only-verified --json > truffle.json

pip install git-filter-repo
git filter-repo --replace-text secrets-to-redact.txt --force
```

```toml
# .gitleaks.toml
[allowlist]
paths = ['''(^|/)test/fixtures/.*''']
```