# Secrets in Environment Files and Configuration

> Detects sensitive secrets hardcoded in .env files, configuration files, and infrastructure definitions that may be committed to version control.

- Skill: `zakirkun/secrets-in-environment-files-and-configuration` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/secrets-in-environment-files-and-configuration`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/secrets-in-environment-files-and-configuration/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/secrets-in-environment-files-and-configuration

---


# Secrets in Environment Files and Configuration

## Overview
Secrets in `.env`, `config.yaml`, `docker-compose.yml`, and similar files are frequently committed to Git repositories (including public ones), exposing credentials, API keys, and tokens. This is one of the most common causes of cloud breaches.

## Detection Strategy
- `.env` files with actual values (not placeholders)
- `docker-compose.yml` with hardcoded credentials
- CI/CD configuration files with secrets

## Remediation
- Use `.gitignore` to exclude `.env` files from version control
- Use secret management services (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager)
- Use `${VARIABLE}` placeholders in config files, with actual values injected at runtime
- Rotate any secrets that have been committed — assume they are compromised