# Scan Secrets

> Scan for exposed secrets and credentials in codebase

- Skill: `tools-only/scan-secrets` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add tools-only/scan-secrets`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tools-only/scan-secrets/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: tools-only (https://skillmd.com/u/tools-only)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/tools-only/scan-secrets

---

# Secret Scanner

Scan codebase for exposed secrets, API keys, passwords, tokens, and sensitive credentials that should not be committed to version control.

## Detection Methods

1. **Pattern Matching**
   - API keys (AWS, Google, Azure, Stripe, etc.)
   - Private keys (RSA, SSH, PGP)
   - Database credentials
   - OAuth tokens
   - JWT tokens
   - Passwords in configuration files

2. **Entropy Analysis**
   - High-entropy strings (base64, hex)
   - Random-looking strings that may be secrets
   - Cryptographic keys

3. **Common Mistakes**
   - Hardcoded credentials in source code
   - Credentials in commit history
   - Secrets in configuration files
   - Environment variables committed to repo
   - Backup files containing secrets

4. **File Type Analysis**
   - .env files
   - Configuration files
   - Shell scripts
   - Docker files
   - CI/CD configuration

## Report Output

Generate detailed secret exposure report with:
- Location of each secret (file, line number)
- Type of secret detected
- Severity level (Critical, High, Medium)
- Remediation steps
- Git history scan results

## Immediate Actions

For exposed secrets:
1. **Rotate immediately** - Revoke and regenerate
2. **Remove from git history** - Use git-filter-branch or BFG
3. **Update .gitignore** - Prevent future commits
4. **Use secret management** - HashiCorp Vault, AWS Secrets Manager
5. **Enable pre-commit hooks** - Prevent secret commits

## Best Practices

- Never commit secrets to version control
- Use environment variables
- Use secret management tools
- Enable pre-commit secret scanning
- Rotate secrets regularly
- Audit git history periodically