Secret Scan

Secret Scan

Identify exposed secrets and sensitive material in approved targets.

Input Parsing

Accept input as: ACTION TARGET [MODE]

Actions:

• repo <owner/repo>
• org <org-name>
• user <username>
• dork <search phrase>
• local <path>

Modes:

• plan: recommendations + command set only
• execute (default, preferred): run commands and report evidence

If mode is omitted, default to execute.

Examples:

• $secret-scan repo owner/repo
• $secret-scan org acme-corp execute
• $secret-scan local ./src execute
• $secret-scan dork "Acme Corp"

Execution Policy

• Always generate a plan first.
• In execute mode, run routine in-scope command batches autonomously.
• Request approval only for OPSEC-dangerous command batches.
• Only scan authorized targets provided by the user.
• Capture exact commands and key output evidence in the report.

Tool Preference

1. trufflehog (preferred)
2. gitleaks
3. manual grep-based fallback

Check availability:

which trufflehog
which gitleaks
which gh

Workflow

1. Create output directory:
   • mkdir -p recon/secret-scan/
2. Build a target-specific command plan.
3. In execute mode:
   • run routine in-scope commands autonomously,
   • request approval only for OPSEC-dangerous steps,
   • collect outputs and triage.
4. Produce findings with severity and confidence labels.
5. Save report to:
   • recon/secret-scan/<target-slug>-report.md

Command Patterns

repo

# Preferred
trufflehog github --repo=https://github.com/<owner/repo> --only-verified --json

# Alternative
git clone --mirror https://github.com/<owner/repo> /tmp/secret-scan-target
gitleaks detect --source /tmp/secret-scan-target --report-format json --report-path recon/secret-scan/gitleaks.json

org

gh repo list <org> --public --limit 200 --json name,url,pushedAt
trufflehog github --org=<org> --only-verified --json

user

gh repo list <user> --public --limit 100 --json name,url,pushedAt

dork

gh search code "<query>" --limit 20 --json repository,path,textMatches

local

trufflehog filesystem <path> --json
# or
gitleaks detect --source <path> --report-format json --report-path recon/secret-scan/gitleaks-local.json

manual fallback patterns

grep -RInE 'AKIA[0-9A-Z]{16}|BEGIN [A-Z ]*PRIVATE KEY|api[_-]?key|token|password\\s*[:=]' <path>
grep -RInE 'mongodb(\\+srv)?://|postgres(ql)?://|mysql://|redis://|amqp://' <path>

Triage Rules

• Confirm whether value appears live/real vs placeholder/test string.
• Prioritize:
  1. active credentials and tokens,
  2. private keys/certs,
  3. database connection strings,
  4. internal endpoints and sensitive config.
• Avoid publishing raw secret values in final report unless explicitly required; use redaction where possible.

Output Format

# Secret Scan Report ? <target>
## Action: <repo|org|user|dork|local>
## Mode: <plan|execute>

## Executive Summary
- High-level findings and risk.

## Commands
- exact command
- execution status

## Findings
- secret type
- location (file/path/repo + line)
- confidence
- impact
- recommended response (rotate/revoke/remove/history rewrite)

## Next Steps
1. immediate containment
2. cleanup and hardening
3. verification rerun

Quality Rules

• Keep findings evidence-based and reproducible.
• Separate confirmed secrets from unverified candidates.
• Include exact commands and output snippets for all executed steps.