crypto-secrets

What problem does it solve?

Audit application source code and configuration for cryptography and secrets hygiene issues: hardcoded API keys, committed .env files, private keys, weak hashes, insecure encryption modes, unsafe randomness, bad KDF/password hashing, JWT signing mistakes, disabled TLS verification, and dangerous serialization. Runs a dependency-free offline scanner for high-recall findings, then the model confirms impact and writes concrete fixes with redacted evidence. Use when reviewing app code that handles encryption, tokens, sessions, certificates, or credentials; when asked to scan for hardcoded secrets, exposed API keys, weak crypto, AES-ECB/CBC misuse, MD5/SHA1 password hashing, insecure random tokens, verify=False, InsecureSkipVerify, rejectUnauthorized false, alg none JWTs, or committed private keys. Not for Terraform/Kubernetes-only audits (use infra-security), package install-hook risk (use supply-chain-security), or vetting an agent skill before install (use skill-security).

Core Features & Use Cases

• Stage 1 — the scanner: deterministically walks your target and flags weak crypto, insecure TLS/JWT patterns, and secret signatures without executing code.
• Stage 2 — semantic judgment: you review each finding with context to confirm live secrets, assess exploitability, and craft concrete remediations with redacted evidence.
• Output and guardrails: all results are returned with redacted secret values and actionable fixes, suitable for integration into risk reports.

Quick Start

Run the crypto-secrets scanner on your target directory to detect hardcoded keys and weak crypto.