secret-scanner

Detecting secrets in repositories involves scanning for hardcoded API keys, tokens, and credentials before they're exposed. This Skill uses Gitleaks to scan your codebase, working tree, or remote repositories and outputs structured reports with location, severity, and remediation guidance to prevent accidental leaks.

Yes, secret scanning works on both local directories and remote repositories. You can run on-demand scans of your working tree or specify a path, making it suitable for development workflows, CI pipelines, and security audits with JSON-formatted output for automation.

A secrets scan report includes the file location, line number, severity level, commit hash, author, date, and redacted secret details. The structured JSON output also provides CWE mappings and remediation hints to help you address findings and understand the security impact.

Secret scanning integrates into CI workflows through configurable exit codes and JSON output formats, enabling automation and reporting. You can run scans on-demand or as part of repository checks, with results that feed directly into security monitoring and compliance reporting systems.

Scanning before secrets reach production catches credentials in development or pre-commit stages, preventing exposure. Post-commit scanning in CI detects leaks that bypassed earlier checks, supporting incident response; both approaches use the same detection mechanism but operate at different points in the development lifecycle.