canary

Scanning for exposed API keys involves checking common local locations like env files, shell history, and git artifacts. This tool performs local-only scans of these sensitive stores to detect exposed credentials without displaying full secret values.

Checking for leaked credentials requires auditing installed skill directories and local cloud or SSH stores. A deep audit comprehensively scans these locations to find weak credential protections and explain the findings in plain language.

Automatically fixing exposed secrets is supported through guided repairs. The tool requires explicit user confirmation before applying any auto-fix and creates encrypted backups, ensuring you maintain control over the security hardening process.

Secrets detection works with cloud credentials, SSH keys, and git artifacts by scanning these sensitive stores locally. It identifies exposed tokens and passwords during both startup light scans and user-triggered deep audits.

A deep audit for security hardening should be run when you need a comprehensive review of installed skill directories and sensitive stores. Startup light scans only check high-risk locations, while deep audits cover env files and shell history thoroughly.

Hiding full secret values during credential scanning satisfies safety requirements and prevents accidental exposure. The tool explains what it finds and why it matters in plain language without dumping sensitive values to the screen.