skills.rest
machenjie
machenjieCOMMUNITY
Explore all skills by this author →
GitHub

secret-configuration-security

Review secret and configuration changes for supply-chain exposure and redaction readiness.

4|Updated May 16, 2026
Search Tags:#secret management#CI/CD#redaction#supply chain security#rotation#KMS#frontend exposure
One-click install
npx skills add https://github.com/machenjie/rd-skills --skill secret-configuration-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: secret-configuration-security
Source: https://github.com/machenjie/rd-skills/tree/main/src/foundation/capabilities/secret-configuration-security
Command: npx skills add https://github.com/machenjie/rd-skills --skill secret-configuration-security

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill prevents secrets and production-sensitive configuration from being exposed anywhere in your software supply chain, from source control through builds, deployments, and documentation.

Core Features & Use Cases

  • Prevents credential and secret exposure across Git history, build artifacts, container images, CI/CD logs, frontend bundles, and support tooling.
  • Enforces secure redaction practices so tokens, credentials, and authorization headers are never logged, traced, or surfaced unredacted.
  • Guides safe secret rotation and revocation with a create → update consumers → verify → revoke workflow that avoids incidents.

Quick Start

Use the secret-configuration-security capability to review a change that adds or modifies API keys, environment variables, KMS/secret-manager policy, or security-sensitive configuration and produce a supply-chain safe, redaction-ready plan before deployment.

Frequently Asked Questions about secret-configuration-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent secrets from leaking into CI/CD logs and frontend bundles?▼

Prevent secret exposure across CI/CD logs and frontend bundles by enforcing allowlist-based redaction for tokens and credentials, ensuring sensitive data is never surfaced unredacted during builds or deployments.

What is the safest sequence for rotating API keys without causing deployment incidents?▼

Safe secret rotation requires a create, update consumers, verify, and revoke workflow to ensure all dependencies are updated before the old credentials are deactivated.

How do I stop build-time secret embedding in container images?▼

Stop build-time secret embedding in container images by enforcing strict non-commit rules and sourcing production-sensitive configuration dynamically at runtime rather than baking it into build artifacts.

Do I need KMS policies for frontend exposure redaction?▼

KMS and secret-manager policies are required to scope named least-privilege access, while allowlist-based redaction independently prevents authorization headers from being exposed in frontend bundles.

What are the limitations of redacting sensitive configuration in source control?▼

Redaction limitations include the inability to remove secrets already committed to Git history without rewriting the repository, requiring strict non-commit rules to prevent initial exposure.

Related Skills

Explore More Legal & Compliance Skills→
2nth-ai2nth-ai
1

tech/google/cloud/security

Manage GCP security configurations, IAM policies, secrets, and encryption keys.

Official
Advanced
api7api7
1

a6-plugin-hmac-auth

Configure APISIX hmac-auth plugin via a6 CLI for routes and consumers.

Official
Intermediate
avvaleavvale

conventional-commits

Validate commit messages against the Conventional Commits specification.

Official
Basic
yashvinthanyashvinthan

secrets-management

Manage secrets in CI/CD pipelines with Vault or AWS Secrets Manager.

Community
Advanced