check-no-secrets

Scan codebases for secrets, credentials, and API keys using ripgrep and git.

Updated Aug 27, 2026

Search Tags:#git #security #secrets #credentials #api keys #code scanning

Ready to run

npx skills add https://github.com/Async-IO/pierre_mcp_server --skill check-no-secrets

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: check-no-secrets
Source: https://github.com/Async-IO/pierre_mcp_server/tree/main/.claude/skills/check-no-secrets
Command: npx skills add https://github.com/Async-IO/pierre_mcp_server --skill check-no-secrets

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill prevents catastrophic security breaches by scanning your codebase for accidentally committed secrets, credentials, API keys, and sensitive data.

Core Features & Use Cases

Automated Secret Detection: Utilizes ripgrep and git to find common secret patterns like API keys, passwords, tokens, and database URLs.
Environment Variable Validation: Ensures secrets are loaded from environment variables, not hardcoded.
Git History Check: Scans git history for previously leaked credentials.
Use Case: Before merging a pull request, run this skill to automatically audit the code for any hardcoded API keys or database credentials that could be exposed.

Quick Start

Run the automated secret detection script to scan your codebase for sensitive information.

Frequently Asked Questions about check-no-secrets

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan my codebase for accidentally committed secrets and API keys?▼

Scanning a codebase for accidentally committed secrets involves using ripgrep and git to detect hardcoded API keys, passwords, tokens, and database URLs. This automated secret detection prevents security breaches by validating environment variable usage before merging pull requests.

Does check-no-secrets check git history for previously leaked credentials?▼

Checking git history for previously leaked credentials is a core feature. The skill validates that secrets are loaded from environment variables rather than hardcoded, and scans previous commits to ensure no sensitive data was exposed in the past.

What do I need to run automated secret detection on my code?▼

To run automated secret detection, you need ripgrep and git installed in your environment. These dependencies power the codebase scanning engine to find common secret patterns and enforce CLAUDE.md security compliance.

What's the best way to validate environment variable usage for secrets before a pull request?▼

The best way to validate environment variable usage for secrets before a pull request is to run an automated code audit that ensures secrets are loaded from environment variables instead of being hardcoded. This enforces security compliance and prevents accidental credential exposure.

Why should I scan for hardcoded database URLs and tokens in my code?▼

Scanning for hardcoded database URLs and tokens is necessary to prevent catastrophic security breaches. Accidentally committed secrets, credentials, and API keys can be exploited if exposed, making automated secret detection essential for maintaining codebase security.

When should I not rely solely on regex-based code scanning for secrets?▼

Regex-based code scanning for secrets has limitations when detecting complex or non-standard credential formats. While ripgrep finds common secret patterns effectively, you should also validate environment variable usage and check git history to ensure comprehensive security coverage.