secret-scanner

Detect hardcoded secrets, API keys, and credentials in code repositories.

22|8|Updated Mar 14, 2026

Search Tags:#security #vulnerability #credentials #api keys #code scanning #secret scanner

Ready to run

npx skills add https://github.com/inbharatai/claude-skills --skill secret-scanner-inbharatai

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: secret-scanner
Source: https://github.com/inbharatai/claude-skills/tree/main/skills/secret-scanner
Command: npx skills add https://github.com/inbharatai/claude-skills --skill secret-scanner-inbharatai

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps identify and flag hardcoded secrets, API keys, and sensitive credentials within codebases, preventing potential security breaches.

Core Features & Use Cases

Secret Detection: Automatically scans code for common patterns of secrets like API keys, passwords, and tokens.
Remediation Guidance: Provides suggestions on how to remove or secure detected secrets.
Use Case: Before deploying new code, run this Skill to ensure no sensitive credentials have been accidentally committed, safeguarding your systems.

Quick Start

Scan the current project directory for any hardcoded secrets.

Frequently Asked Questions about secret-scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan code for hardcoded secrets and API keys before deployment?▼

To scan code for hardcoded secrets, you can use static analysis and pattern matching to detect sensitive credentials within your repository. This process flags potential vulnerabilities and provides remediation guidance to secure your codebase before deployment.

What is secret detection in code repositories and how does it work?▼

Secret detection in code repositories is the process of identifying hardcoded API keys, passwords, and tokens using pattern matching. It works by scanning codebases to flag sensitive credentials, preventing accidental commits and potential security breaches.

Can I use a secret scanner for pre-deployment security checks?▼

Yes, you can use a secret scanner for pre-deployment security checks. It automatically analyzes your project directory to identify hardcoded credentials, ensuring no sensitive data is accidentally committed before you deploy new code.

What are the limitations of pattern matching for finding hardcoded credentials?▼

Pattern matching for finding hardcoded credentials requires integration with static analysis tools to identify sensitive data effectively. It focuses on common secret patterns like API keys and passwords, meaning non-standard or dynamically constructed credentials might not be detected.

How do I remove or secure detected API keys during a code review?▼

To remove or secure detected API keys during a code review, follow the remediation guidance provided by the scanner. This typically involves removing the hardcoded credentials from the code and moving them to secure environment variables or secret management systems.