secret-handling

Preventing credential leakage requires prohibiting automated agents from reading .env files and blocking writes of secrets to committed files. This skill enforces strict environment handling and pre-commit checks to block dangerous commits.

Setting up pre-commit validation scans staged changes for sensitive data and blocks commits containing secrets before they enter git history. This provides a security guardrail that stops credential exposure during automated workflows.

Safe alternatives to committing .env files include using .env.example or .env.sample templates. These allow you to share configuration structures without exposing actual credentials, maintaining git safety across automated agents.

Remediation guidance for exposed secrets involves following explicit env handling protocols to identify and remove leaked credentials from committed files. You must scan your git history to locate sensitive data and secure the repository.

Yes, this approach precludes credential leakage by prohibiting agents from reading sensitive environment files and writing secrets to committed files. It ensures safe alternatives exist and enforces pre-commit checks for automated git workflows.

A key limitation is that if secrets bypass pre-commit checks and enter git history, the skill cannot automatically rewrite past commits. It provides remediation guidance for exposed secrets, but manual intervention is required to scrub committed credentials.