check-no-secrets

Scanning a codebase for accidentally committed secrets involves using ripgrep and git to detect hardcoded API keys, passwords, tokens, and database URLs. This automated secret detection prevents security breaches by validating environment variable usage before merging pull requests.

Checking git history for previously leaked credentials is a core feature. The skill validates that secrets are loaded from environment variables rather than hardcoded, and scans previous commits to ensure no sensitive data was exposed in the past.

To run automated secret detection, you need ripgrep and git installed in your environment. These dependencies power the codebase scanning engine to find common secret patterns and enforce CLAUDE.md security compliance.

The best way to validate environment variable usage for secrets before a pull request is to run an automated code audit that ensures secrets are loaded from environment variables instead of being hardcoded. This enforces security compliance and prevents accidental credential exposure.

Scanning for hardcoded database URLs and tokens is necessary to prevent catastrophic security breaches. Accidentally committed secrets, credentials, and API keys can be exploited if exposed, making automated secret detection essential for maintaining codebase security.

Regex-based code scanning for secrets has limitations when detecting complex or non-standard credential formats. While ripgrep finds common secret patterns effectively, you should also validate environment variable usage and check git history to ensure comprehensive security coverage.