secrets

Scan git history and working trees for committed secrets and insecure secret practices.

Updated Jun 24, 2026

Search Tags:#security #codebase #audit #secrets #credentials #gitignore

Ready to run

npx skills add https://github.com/eriknovak/ErikNovak --skill secrets

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: secrets
Source: https://github.com/eriknovak/ErikNovak/tree/main/.dotfiles/.claude/skills/secrets
Command: npx skills add https://github.com/eriknovak/ErikNovak --skill secrets

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Audits codebases for secret handling issues, helping teams detect leaked credentials, misconfigurations in environment management, and insecure patterns early in the development lifecycle.

Core Features & Use Cases

Committed secrets detection across git history and the current working tree.
Gitignore validation to ensure sensitive files like .env, keys, and credentials are ignored.
Template verification to ensure .env.example or .env.template exist when .env usage is present.
Hardcoded secret detection in source code with guidance for remediation and safe handling of credentials.
Real-world scenario: routinely scan a mid-sized repository to surface secret exposures before deployment.

Quick Start

Audit secrets in your repository by instructing Claude to examine code for exposure patterns and misconfigurations.

Frequently Asked Questions about secrets

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan a codebase for committed secrets and credential leaks?▼

Scanning for committed secrets involves checking both git history and the current working tree to detect leaked credentials. This audit identifies hardcoded secret patterns and insecure practices, delivering a structured risk report with remediation guidance.

What is the best way to validate .gitignore rules for sensitive files?▼

Gitignore validation checks that sensitive files like .env, keys, and credentials are properly ignored. The audit surfaces gitignore gaps where secret files might be accidentally committed, ensuring misconfigurations in environment management are caught early.

Can I detect hardcoded credentials in source code across repositories of varying sizes?▼

Yes, hardcoded secret detection works across repositories of varying languages and sizes. The scan identifies credentials directly in source code and provides guidance for remediation and safe handling of those exposed secrets.

Why do I need an .env.example template when using .env files?▼

An .env.example or .env.template documents required environment variables without exposing actual secrets. The audit performs template verification to ensure these files exist when .env usage is present, preventing configuration gaps for new developers.

Does the secret audit check the entire git history or just the current working tree?▼

The secret audit performs both history-wide and working-tree checks. This dual approach detects leaked credentials committed in previous commits as well as hardcoded secret patterns currently present in the active codebase.

What limitations exist when auditing for secrets in a mid-sized repository?▼

The audit focuses on detecting committed secrets, gitignore gaps, env template presence, and hardcoded patterns. It does not alter or remove secrets automatically; it delivers structured risk reports with remediation guidance that developers must act on manually.