secret-hygiene

Detect leaked credentials in git history and local files.

15|Updated May 12, 2026

Search Tags:#git #security #secrets #credentials #credential rotation #leak detection

Ready to run

npx skills add https://github.com/GoldenWing-360/claude-security-skills --skill secret-hygiene-goldenwing-360

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: secret-hygiene
Source: https://github.com/GoldenWing-360/claude-security-skills/tree/main/secret-hygiene
Command: npx skills add https://github.com/GoldenWing-360/claude-security-skills --skill secret-hygiene-goldenwing-360

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Credential leaks compromise security by exposing sensitive access keys and passwords, leading to potential misuse or data breaches.

Core Features & Use Cases

Leak Detection: Identifies exposed secrets in git history and local files using tools like gitleaks and trufflehog.
Secret Rotation: Guides secure rotation workflows by invalidating leaked secrets and updating downstream systems.
Preventive Measures: Implements pre-commit hooks and best practices to avoid future leaks, including secret scanning and access scoping.
Use Case: When a developer commits a private API key to a repository, this Skill helps detect the leak, guides secret invalidation, and sets up preventative scans to avoid recurrence.

Quick Start

Use secret-hygiene to scan your local project for any accidentally committed secrets or insecure credentials.

Frequently Asked Questions about secret-hygiene

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan git history for leaked credentials and API keys?▼

To detect leaked credentials in git history, you can scan repositories and local files using tools like gitleaks and trufflehog. This identifies exposed secrets and sensitive access keys to prevent potential data breaches across your development workflow.

What is the best way to rotate exposed secrets after a credential leak?▼

The best way to rotate exposed secrets is to follow a guided secure rotation workflow that invalidates leaked credentials and updates downstream systems. This ensures compromised access keys and passwords are securely replaced across cloud, git, and local environments.

How do I set up pre-commit hooks to prevent committing secrets?▼

Preventing future leaks involves implementing pre-commit hooks and best practices for secret scanning within your development workflow. This proactively blocks sensitive credentials from entering git repositories by enforcing access scoping and automated checks.

Can I detect leaked secrets across both cloud and local environments?▼

Yes, you can detect and manage leaked secrets across cloud, git, and local environments. This approach supports organizations handling multiple secrets by scanning repositories and local files to maintain security integrity across diverse systems.

What should I do if a private API key is accidentally committed to git?▼

If a private API key is committed to git, you must detect the leak, guide secret invalidation, and set up preventative scans. This involves rotating the exposed credential and updating downstream systems to avoid recurrence.