What problem does it solve? Hardcoded credentials, long-lived static keys, and secrets committed to git history are the root cause of most breaches, and teams often stop at deleting the value from code without rotating it at the provider. This Skill manages the full secret lifecycle — detection, prevention, vaulting, rotation, and leak response — so credentials stay short-lived, least-privilege, and out of the codebase. ## Core Features & Use Cases - Secret Scanning Gates: Configure pre-commit hooks and CI checks with gitleaks to block secrets before they reach the default branch, with tuned allowlists that keep false positives low. - Vaulting and Dynamic Credentials: Migrate static keys into brokers like HashiCorp Vault or cloud KMS, issuing short-lived, least-privilege database and cloud credentials that expire in minutes. - Leak-Response Runbooks: Execute a five-step response that rotates at the provider first, then removes from code, purges git history, and audits usage across the exposure window. - Use Case: A developer accidentally commits an AWS key. The Skill guides you to revoke it in IAM immediately, replace it with a broker reference, purge it from history with filter-repo, and audit CloudTrail for use during the exposure window. ## Quick Start Ask the agent to audit this repository for exposed secrets and set up pre-commit and CI scanning with a rotation plan for any credentials found.
