secrets

Scans source code, configuration files, and git history for hardcoded credentials, API keys, tokens, and private keys.

12|1|Updated Feb 9, 2026

Search Tags:#security #vulnerability #secrets #credentials #api keys #code scanning

Ready to run

npx skills add https://github.com/florianbuetow/claude-code --skill secrets-florianbuetow

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: secrets
Source: https://github.com/florianbuetow/claude-code/tree/main/plugins/appsec/skills/secrets
Command: npx skills add https://github.com/florianbuetow/claude-code --skill secrets-florianbuetow

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill automatically detects and flags hardcoded secrets, credentials, API keys, and other sensitive information within your codebase, preventing accidental exposure and potential security breaches.

Core Features & Use Cases

Comprehensive Scanning: Analyzes source code, configuration files, and git history for various types of secrets.
Contextual Analysis: Identifies secrets based on patterns, variable names, and file types.
Use Case: Before committing code, run this Skill to ensure no API keys or database passwords are accidentally included, safeguarding your application's security.

Quick Start

Use the secrets skill to scan the current directory for any hardcoded credentials.

Frequently Asked Questions about secrets

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan source code for hardcoded secrets and API keys?▼

To scan source code for hardcoded secrets, this Skill analyzes your files and git history to detect exposed API keys, tokens, and private keys. It identifies sensitive information using detection patterns, variable names, and file types.

What types of credentials can a code scanner detect in configuration files?▼

A code scanner detects cloud provider keys, service-specific tokens, passwords, private keys, and high-entropy strings. It comprehensively checks source code, .env files, configuration files, and git history for these hardcoded credentials.

Can I use gitleaks and trufflehog to find passwords in git history?▼

Yes, you can use gitleaks and trufflehog alongside trivy to find passwords in git history. This Skill integrates with these scanners to provide enhanced detection of hardcoded secrets and credentials across your codebase.

How do I check for exposed environment variables before committing code?▼

To check for exposed environment variables before committing, run this Skill to scan the current directory. It analyzes .env files and configuration files to ensure no database passwords or API keys are accidentally included.

What is the best way to detect high-entropy strings and private keys in a repository?▼

The best way to detect high-entropy strings and private keys is using contextual analysis. This Skill scans source code and git history, identifying secrets based on variable names, file types, and specific cloud provider key patterns.