secret-handling

To prevent credential leakage into git history, a pre-commit validation mechanism scans staged `.squad/` files for secret patterns and blocks the commit. This skill enforces that by removing offending files from staging and reporting the exact detected pattern.

Pre-commit secret scanning blocks AI agents from reading sensitive `.env*` files except explicitly allowlisted templates like `.env.example`. It applies regex-based staged-content scanning to prevent writing API keys, passwords, and private keys into auto-committed artifacts.

Yes, automated commit blocking stops PII and API key exposure by applying fail-loud validation with clear user reporting. It detects common secret patterns, cloud credentials, and email-like PII in staged content before they reach remote history.

The best way to handle discovered credential leaks is immediate alerting, credential rotation, and history cleanup. This skill instructs safe remediation for discovered leaks without attempting automatic fixes to ensure sensitive data is properly invalidated.

AI agents read `.env` files during spawned-agent workflows because repository-wide read access can expose live credentials. This skill prohibits live secret file reads and requires explicit allowlisted config templates to prevent unintended credential disclosure.