secret-protection

Scan .env files, code, and diffs for exposed secrets and redact runtime outputs.

31|8|Updated Apr 10, 2026

Search Tags:#pre-commit #redaction #gitleaks #secret protection #secret rotation #credential scanning #ci/cd gate

Ready to run

npx skills add https://github.com/itallstartedwithaidea/agent-skills --skill secret-protection

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: secret-protection
Source: https://github.com/itallstartedwithaidea/agent-skills/tree/main/skills/security/secret-protection
Command: npx skills add https://github.com/itallstartedwithaidea/agent-skills --skill secret-protection

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Secret Protection prevents credentials from leaking into source control, CI artifacts, logs, or AI conversation history by detecting secrets early and redacting them when they appear.

Core Features & Use Cases

Three-layer protection: Blocks commits via pre-commit scanning, fails CI/CD diffs when secrets are present, and performs runtime detection with redaction to keep production safe.
Zero-tolerance enforcement: Treats any detected secret as a blocker and requires remediation rather than allowing risky exceptions.
Secret rotation policies: Limits blast radius by enforcing rotation schedules based on detected secret severity.
Use case: Set up a new repository and its pipelines so that committing an accidentally included API key is automatically prevented and the key is rotated if it ever reaches later stages.

Quick Start

Use the secret-protection skill to configure pre-commit scanning, CI/CD secret gates, and runtime redaction for logs and agent outputs in your repository.

Frequently Asked Questions about secret-protection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I prevent credentials and API keys from leaking into Git history?▼

Prevent credential leaks by scanning .env files, code, and diffs using pre-commit hooks. This blocks exposed secrets before they ship, ensuring accidental API key inclusions are automatically rejected.

What is the best way to set up a CI/CD gate for secret scanning?▼

Configure CI/CD secret scanning gates to fail build diffs when exposed secrets are detected. This zero-tolerance enforcement treats any finding as a blocker, requiring remediation before deployments can proceed.

How does runtime redaction protect logs and AI agent conversations?▼

Runtime redaction protects logs and AI agent conversations by detecting and masking sensitive values as they appear in outputs. This prevents production secrets from being exposed in conversation history or runtime artifacts.

Can I enforce secret rotation schedules based on detected severity?▼

Yes, you can enforce secret rotation policies to limit blast radius. The system applies rotation schedules based on detected secret severity, ensuring compromised credentials are rotated if they reach later pipeline stages.

Does this secret scanning approach work for auditing existing codebases?▼

Yes, this approach applies to auditing existing codebases by scanning current code and diffs for exposed secrets. It enforces a three-ring detection model across pre-commit, CI/CD, and runtime environments to secure established repositories.