What problem does it solve? A single synthetic token that looks like a real credential causes GitHub push protection to reject an entire push, blocking unrelated commits and forcing costly history rewrites. This Skill teaches how to write test fixtures, examples, and documentation without ever producing a secret-shaped string. ## Core Features & Use Cases - Secret-shape detection rules: Explains what scanners match — a vendor prefix (ghp_, sk_live_, AKIA, etc.) plus a random-looking body — so you know exactly what to avoid. - Safe fixture techniques: Shows the two-concatenated-literals pattern for building runtime tokens that no single source literal matches, plus safe placeholder forms like <your-api-key>. - Documentation guidance: Describes tokens in words or truncated form instead of quoting realistic examples. - Recovery workflow: Step-by-step handling when a push is already rejected, including history cleanup and why the bypass link must never be used. - Use Case: Before writing an authentication test fixture or a README example showing an API key, consult this Skill to produce a value that works at runtime but never trips secret scanning. ## Quick Start Before writing any example API key, token fixture, or connection string, apply this Skill to verify the literal is not secret-shaped and assemble runtime tokens from two concatenated literals instead.
