detecting-secrets

Name: detecting-secrets
Availability: InStock
Author: qte77

Detect hardcoded secrets and credentials in code and git history.

2|1|Updated Feb 22, 2026

Search Tags:#security #secrets #detection #best-practices #git-history #code-audit #credential-rotation

Ready to run

npx skills add https://github.com/qte77/claude-code-plugins --skill detecting-secrets

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: detecting-secrets
Source: https://github.com/qte77/claude-code-plugins/tree/main/plugins/security-audit/skills/detecting-secrets
Command: npx skills add https://github.com/qte77/claude-code-plugins --skill detecting-secrets

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Detects and flags hardcoded secrets, API keys, tokens, and credentials in code and git history to prevent leakage and secure software workflows.

Core Features & Use Cases

Secret pattern scanning across codebases and history
Git history analysis to uncover leaked credentials
Clear remediation guidance and rotation planning
Pre-publish checks for PRs and CI pipelines to block sensitive data exposure

Quick Start

Scan your repository to locate secrets and receive a remediation plan.

Frequently Asked Questions about detecting-secrets

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan my git history to find hardcoded secrets and credentials?▼

To scan git history for hardcoded secrets, the tool analyzes commits and source files to locate leaked credentials. It returns a structured list detailing the secret type, location, pattern match, and recommended remediation actions.

What is the best way to detect API keys in source files before merging a pull request?▼

Running pre-publish checks on pull requests detects API keys in source and configuration files before merging. This blocks sensitive data exposure and provides clear remediation guidance to secure your workflow.

Can I integrate hardcoded secret detection into my CI pipelines?▼

Yes, hardcoded secret detection integrates into CI pipelines by scanning codebases, commits, and pull requests. It blocks sensitive data exposure and returns findings with type, location, pattern match, and remediation recommendations.

How do I remediate leaked credentials found during a code audit?▼

Remediate leaked credentials found during a code audit by following the provided remediation guidance and rotation planning. This ensures compromised tokens and API keys are securely replaced across your software workflows.

Does secret pattern scanning work on configuration files as well as source code?▼

Yes, secret pattern scanning works on configuration files and source code. It identifies and flags hardcoded secrets across codebases, commits, and pull requests to prevent leakage and secure software workflows.

When should I perform credential rotation after detecting secrets in my codebase?▼

Perform credential rotation immediately after detecting secrets in your codebase. The tool provides rotation planning and remediation guidance to ensure compromised tokens are securely replaced and exposure is mitigated.