Profile My skills Saved Collections Edit profile Submit a skill

Secrets in Environment Files and Configuration

Detects sensitive secrets hardcoded in .env files, configuration files, and infrastructure definitions that may be committed to version control.

zakirkun Updated
DevOps & Infra

File contents

Secrets in Environment Files and Configuration

Overview

Secrets in .env, config.yaml, docker-compose.yml, and similar files are frequently committed to Git repositories (including public ones), exposing credentials, API keys, and tokens. This is one of the most common causes of cloud breaches.

Detection Strategy

  • .env files with actual values (not placeholders)
  • docker-compose.yml with hardcoded credentials
  • CI/CD configuration files with secrets

Remediation

  • Use .gitignore to exclude .env files from version control
  • Use secret management services (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager)
  • Use ${VARIABLE} placeholders in config files, with actual values injected at runtime
  • Rotate any secrets that have been committed — assume they are compromised

zakirkun/ice-tea/tree/main/skills/cloud/secrets-in-env commit 441f653896

Browse category

Frequently asked questions

npx skillmds@latest add zakirkun/secrets-in-environment-files-and-configuration