secret-scan

Scan codebases to detect committed secrets, tokens, and credentials.

11|Updated Apr 16, 2026

Search Tags:#git #security #codebase #secrets #credentials #tokens #scan

Ready to run

npx skills add https://github.com/berkcangumusisik/claude-code-practices --skill secret-scan-berkcangumusisik

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: secret-scan
Source: https://github.com/berkcangumusisik/claude-code-practices/tree/main/skills/secret-scan
Command: npx skills add https://github.com/berkcangumusisik/claude-code-practices --skill secret-scan-berkcangumusisik

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Scans codebases to detect accidentally committed secrets, tokens, and credentials, helping teams prevent credential leakage.

Core Features & Use Cases

Pattern-based detection across files to surface secrets such as API keys, tokens, passwords, and credentials.
Reports include file paths and line numbers with redacted secret values to aid triage without exposing sensitive data.
Use Case: Before merging a PR, run the scan to identify any hard-coded credentials and remediate before deployment.

Quick Start

Run the secret-scan tool on your repository to surface leaked secrets and review the generated report.

Frequently Asked Questions about secret-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan a Git repository for accidentally committed secrets and API keys?▼

To scan a Git repository for leaked secrets, run a pattern-based detection tool across your codebase files to surface hard-coded API keys, tokens, and credentials, generating a report with file paths and line numbers for triage.

What is the best way to find hard-coded credentials before merging a pull request?▼

The best way to find hard-coded credentials before a PR merge is to run a secret scan during code review to identify accidentally committed tokens and remediate them before deployment.

Does secret scanning show the actual values of leaked tokens in the report?▼

Secret scanning reports do not expose sensitive data; they report file paths and line numbers alongside redacted secret values to help teams triage and remediate leaked credentials safely.

Can I use a credentials scan across different programming languages in my codebase?▼

Yes, you can use a credentials scan across different programming languages because the detection requires scanning scripts across languages to match patterns for keys, tokens, and passwords.

When do I need to scan for tokens in a CI pipeline?▼

You need to scan for tokens in a CI pipeline when you want to automatically identify and locate accidentally committed secrets before they reach production environments.

Are there limitations to pattern-based secret detection in codebases?▼

Pattern-based secret detection relies on matching known formats for keys and credentials, meaning it may not surface secrets that lack recognizable structural patterns or are heavily obfuscated within the codebase.