skills.rest
qte77
qte77COMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-secrets

Detect hardcoded secrets and credentials in code and git history.

2|1|Updated Feb 22, 2026
Search Tags:#security#secrets#detection#best-practices#git-history#code-audit#credential-rotation
One-click install
npx skills add https://github.com/qte77/claude-code-plugins --skill detecting-secrets
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-secrets
Source: https://github.com/qte77/claude-code-plugins/tree/main/plugins/security-audit/skills/detecting-secrets
Command: npx skills add https://github.com/qte77/claude-code-plugins --skill detecting-secrets

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Detects and flags hardcoded secrets, API keys, tokens, and credentials in code and git history to prevent leakage and secure software workflows.

Core Features & Use Cases

  • Secret pattern scanning across codebases and history
  • Git history analysis to uncover leaked credentials
  • Clear remediation guidance and rotation planning
  • Pre-publish checks for PRs and CI pipelines to block sensitive data exposure

Quick Start

Scan your repository to locate secrets and receive a remediation plan.

Frequently Asked Questions about detecting-secrets

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan my git history to find hardcoded secrets and credentials?▼

To scan git history for hardcoded secrets, the tool analyzes commits and source files to locate leaked credentials. It returns a structured list detailing the secret type, location, pattern match, and recommended remediation actions.

What is the best way to detect API keys in source files before merging a pull request?▼

Running pre-publish checks on pull requests detects API keys in source and configuration files before merging. This blocks sensitive data exposure and provides clear remediation guidance to secure your workflow.

Can I integrate hardcoded secret detection into my CI pipelines?▼

Yes, hardcoded secret detection integrates into CI pipelines by scanning codebases, commits, and pull requests. It blocks sensitive data exposure and returns findings with type, location, pattern match, and remediation recommendations.

How do I remediate leaked credentials found during a code audit?▼

Remediate leaked credentials found during a code audit by following the provided remediation guidance and rotation planning. This ensures compromised tokens and API keys are securely replaced across your software workflows.

Does secret pattern scanning work on configuration files as well as source code?▼

Yes, secret pattern scanning works on configuration files and source code. It identifies and flags hardcoded secrets across codebases, commits, and pull requests to prevent leakage and secure software workflows.

When should I perform credential rotation after detecting secrets in my codebase?▼

Perform credential rotation immediately after detecting secrets in your codebase. The tool provides rotation planning and remediation guidance to ensure compromised tokens are securely replaced and exposure is mitigated.

Related Skills

Explore More Software Engineering Skills→
julianjabjulianjab

security-audit

Scan codebases for hardcoded secrets and security vulnerabilities.

Community
Intermediate
marquesfelipmarquesfelip

secrets-exposure-detection

Detect exposed credentials and secrets across codebases, logs, and environments.

Community
Advanced
zcacereszcaceres
7

gitleaks

Scan git repositories for exposed credentials using gitleaks.

Community
Advanced
dhruvinrsonidhruvinrsoni

security-review

Review code diffs for OWASP Top 10 vulnerabilities and hardcoded secrets.

Community
Advanced