skills.rest
berkcangumusisik
berkcangumusisikCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

secret-scan

Scan codebases to detect committed secrets, tokens, and credentials.

11|Updated Apr 16, 2026
Search Tags:#git#security#codebase#secrets#credentials#tokens#scan
One-click install
npx skills add https://github.com/berkcangumusisik/claude-code-practices --skill secret-scan-berkcangumusisik
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: secret-scan
Source: https://github.com/berkcangumusisik/claude-code-practices/tree/main/skills/secret-scan
Command: npx skills add https://github.com/berkcangumusisik/claude-code-practices --skill secret-scan-berkcangumusisik

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Scans codebases to detect accidentally committed secrets, tokens, and credentials, helping teams prevent credential leakage.

Core Features & Use Cases

  • Pattern-based detection across files to surface secrets such as API keys, tokens, passwords, and credentials.
  • Reports include file paths and line numbers with redacted secret values to aid triage without exposing sensitive data.
  • Use Case: Before merging a PR, run the scan to identify any hard-coded credentials and remediate before deployment.

Quick Start

Run the secret-scan tool on your repository to surface leaked secrets and review the generated report.

Frequently Asked Questions about secret-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan a Git repository for accidentally committed secrets and API keys?▼

To scan a Git repository for leaked secrets, run a pattern-based detection tool across your codebase files to surface hard-coded API keys, tokens, and credentials, generating a report with file paths and line numbers for triage.

What is the best way to find hard-coded credentials before merging a pull request?▼

The best way to find hard-coded credentials before a PR merge is to run a secret scan during code review to identify accidentally committed tokens and remediate them before deployment.

Does secret scanning show the actual values of leaked tokens in the report?▼

Secret scanning reports do not expose sensitive data; they report file paths and line numbers alongside redacted secret values to help teams triage and remediate leaked credentials safely.

Can I use a credentials scan across different programming languages in my codebase?▼

Yes, you can use a credentials scan across different programming languages because the detection requires scanning scripts across languages to match patterns for keys, tokens, and passwords.

When do I need to scan for tokens in a CI pipeline?▼

You need to scan for tokens in a CI pipeline when you want to automatically identify and locate accidentally committed secrets before they reach production environments.

Are there limitations to pattern-based secret detection in codebases?▼

Pattern-based secret detection relies on matching known formats for keys and credentials, meaning it may not surface secrets that lack recognizable structural patterns or are heavily obfuscated within the codebase.

Related Skills

Explore More Software Engineering Skills→
jamesjlundinjamesjlundin
32

secrets-scanner

Scan codebases for secrets, credentials, and PII patterns.

Community
Intermediate
rad-securityrad-security
2

secrets

Scan directories for exposed secrets and report masked findings.

Official
Intermediate
heaptracetechnologyheaptracetechnology
13

secrets-scan

Scan codebases for leaked secrets using known patterns and high-entropy strings.

Community
Advanced
truongnattruongnat

security-review

Audits code for OWASP Top 10 vulnerabilities, hardcoded secrets, and unsafe patterns.

Community
Advanced