forge-secrets

What problem does it solve?

This skill prevents accidental exposure of API keys, passwords, tokens, and other credentials by enforcing safe loading, logging, error handling, storage, and rotation practices that stop the most common leak paths.

Core Features & Use Cases

• Secret handling guardrails: no hardcoded credentials, no secret defaults, and no unsafe transport patterns such as bearer tokens in query strings.
• Fail-fast startup validation: required environment variables are validated at boot (optionally via schema validation) so the service crashes instead of running with missing/unsafe config.
• Redaction and error hygiene: all potentially secret-bearing logs are redacted, raw error objects and stack traces are never returned to clients, and client responses use safe error shapes.
• Secure storage & rotation: passwords use argon2id/bcrypt (not SHA-1/MD5/SHA-256), encryption uses AEAD, API tokens are hashed at rest, and rotation includes documented procedures with dual-key grace periods.

Quick Start

Instruct your AI coding agent to add environment-based secret loading with startup validation, configure logger redaction for secret-like fields, and ensure production responses never return stack traces or raw error messages, using forge-secrets as the checklist for any code that touches keys, tokens, passwords, or session secrets.