credential-scanner

To scan your project workspace for exposed API keys and secrets, run a pre-flight check that applies path-aware regex rules to identify sensitive credentials in files like .env and docker-compose.yml. This process generates a sanitized report highlighting any accidental exfiltration risks before execution.

Use a credential scanner in your development environment or CI/CD pipelines before executing new, potentially untrusted skills that require file-read access. This proactive secret detection step prevents security breaches by ensuring no passwords or API keys are inadvertently exposed in your project files.

Pre-flight secret scanning checks common file locations and patterns for exposed credentials, specifically targeting files like .env, docker-compose.yml, and private key files. It utilizes path-aware regex checks and customizable skip rules to accurately identify sensitive data.

Yes, you can customize the scanning scope to optionally include your home directory with explicit consent. By default, the scanner targets the current workspace, but expanding the scope ensures broader coverage for exposed credentials across your local development environment.

Sanitized reporting works by flagging the exact locations of exposed credentials and API keys without dumping the actual sensitive values into the output logs. This mechanism ensures that the security scan results remain safe to read and share while alerting you to potential exfiltration risks.

Yes, credential scanning works effectively within CI/CD pipelines as a pre-flight security check. It scans project workspaces for secrets before any file-read access is granted to subsequent tasks, preventing accidental exfiltration of sensitive credentials during automated deployments.