brewcode:secrets-scan

You can scan git-tracked files for leaked secrets by running the /secrets-scan command. It uses parallel agents to detect hardcoded credentials like API keys and tokens, generating a detailed report categorized by severity.

To remediate leaked credentials, the scan provides interactive options for each detected secret. You can delete the sensitive information, move it to environment variables, or add the file to .gitignore directly from the generated report.

Yes, executing a secrets scan requires an active git repository context and Bash execution access to list files and set up directories for scanning hardcoded credentials and sensitive information.

A secrets scan detects a wide range of hardcoded sensitive information using predefined patterns, including passwords, API keys, tokens, and database credentials accidentally included in your git-tracked files.

Run a secrets scan before committing code to prevent leaked credentials. Integrating this automated scan into your development workflow ensures no sensitive API keys or database credentials are accidentally exposed.