secrets-hunter

Detect hardcoded secrets and credentials in source code repositories.

1|Updated Nov 30, 2025

Search Tags:#auditing #secrets #secret-detection #secret-scanning #code-security #credential-exposure #hardcoded-keys

Ready to run

npx skills add https://github.com/MAF2414/kyco --skill secrets-hunter

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: secrets-hunter
Source: https://github.com/MAF2414/kyco/tree/main/.claude/skills/secrets-hunter
Command: npx skills add https://github.com/MAF2414/kyco --skill secrets-hunter

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Hunt for hardcoded secrets, API keys, tokens, credentials, private keys, and sensitive configuration that should not be in source code.

Core Features & Use Cases

Secret detection: locate API keys, credentials, and keys across languages and repos.
Risk assessment: classify findings by severity and potential exposure.
Audit-ready reports: export structured findings with locations for remediation.

Quick Start

Run a codebase scan to identify embedded secrets and generate a findings report.

Frequently Asked Questions about secrets-hunter

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan a codebase for hardcoded secrets and API keys?▼

Scanning a codebase for hardcoded secrets involves analyzing source code across languages to locate embedded API keys, tokens, and credentials. This Skill scans for common secret patterns and formats to expose sensitive configuration across repositories.

What types of hardcoded credentials can secret detection find?▼

Secret detection identifies hardcoded API keys, tokens, private keys, and sensitive configuration embedded in source code. It scans for common secret patterns and formats to uncover credential exposure across multiple programming languages.

Does secret scanning work for pre-commit reviews and CI pipelines?▼

Yes, secret scanning applies to CI pipelines, pre-commit reviews, and pull-request checks for security auditing. It scans codebases across languages and repositories to identify hardcoded secrets before they leak.

How are detected secrets classified for security auditing?▼

Detected secrets are classified by severity and potential exposure during security auditing. The scanner outputs structured findings with severities and locations, generating audit-ready reports for remediation.

What is the best way to generate audit-ready reports for credential exposure?▼

Generating audit-ready reports for credential exposure requires scanning source code to identify embedded secrets and exporting structured findings. This Skill outputs structured findings with severities and locations for remediation.

When do I need to run a hardcoded key detection scan?▼

Hardcoded key detection scans are needed for security auditing, pre-commit reviews, and pull-request checks. Run a codebase scan to identify embedded secrets and generate a findings report before sensitive configuration leaks.