# Security Check

> Verify repository security and check for secrets using gitleaks Use when this capability is needed.

- Skill: `tomevault-io/security-check-6` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/security-check-6`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/security-check-6/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/security-check-6

---


# Security Check Skill

This skill provides instructions for ensuring the repository is secure and free of secrets.

## Gitleaks Detection

To verify that the repository contains no secrets, run the following command in the repository root:

```bash
gitleaks detect -v
```

### If leaks are found:

1.  **Identify the secret**: The output will show the file path, line number, and the secret string.
2.  **Scrub the secret**:
    *   If the file is tracked, replace the secret with a placeholder (e.g., `your-secret-key`) in the file.
    *   Commit the changes: `git commit -am "Scrub secrets"`
3.  **Historical Clean-up** (if necessary):
    *   If the secret exists in previous commits, you must rewrite history.
    *   Use `git filter-repo --invert-paths --path <file_path> --force` to completely remove the file if possible.
    *   Or use thorough scrubbing techniques.
    *   **Force Push**: `git push --force` is required after rewriting history.

### Verification

Run `gitleaks detect -v` again to confirm no leaks remain.

## Regular Maintenance

*   Run this check before every push or pull request.
*   Update `.gitignore` to exclude sensitivity files like `.env` (unless they are example files with placeholders).

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/cloud-neutral-toolkit) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-15 -->