What problem does it solve? Security teams often find API keys and client credentials in public configs, SDKs, or frontend code but cannot tell whether they are harmless by-design public keys or genuinely dangerous exposures. This Skill provides an evidence-gated workflow to distinguish the two without touching production or third-party systems. ## Core Features & Use Cases - Evidence-Gated Validation: Follows a fixed baseline → single-variable probe → post-baseline → oracle → evidence pipeline so every finding is backed by provider or audit confirmation. - False Positive Filtering: Treats key format, base64 strings, SDK configs, invalid keys, and client-side errors as non-findings, reducing noise in reports. - Strict Safety Boundaries: Only permits testing with self-owned canary keys in sandbox tenants, and stops immediately on real key usage, third-party APIs, billing operations, or irreversible side effects. - Use Case: During an authorized assessment you discover a Google-style API key in a public JavaScript bundle. Use this Skill to plan a safe validation that checks whether the key exceeds its intended origin/referrer restrictions using only your own test project. ## Quick Start Use $hunt-api-key-exposure to plan an evidence-gated, authorized validation path for the API key I found in this client configuration.
