secret-handling

Preventing accidental commits of secrets requires blocking reads of live .env files and scanning staged files with regex patterns to detect API keys, passwords, and private keys before they enter git history. This Skill automates that detection and blocks commits containing sensitive values.

Pre-commit secret scanning is the process of detecting sensitive values in staged files before they are committed. This Skill uses regex patterns to identify API keys, JWTs, and connection strings, then removes the files from staging and instructs users to rotate exposed credentials.

To stop agents from reading live .env files, apply explicit prohibitions against reading .env, .env.production, and .env.local while permitting access to safe placeholder files like .env.example. This Skill enforces those read restrictions and suggests asking users for values directly.

If a secret is detected in git history, you must remove the files from staging, purge the sensitive values from git history using specialized tools, and immediately rotate the exposed credentials. This Skill provides remediation steps to escalate and clean the repository.

Yes, you can apply this secret scanning approach to CI workflows by scanning staged .squad/ files and git history during development. It integrates with Scribe pre-commit hooks and CI pipelines to block commits containing detected secret patterns.