Enforce secret storage, logging, detection, and rotation practices in CI/CD workflows.
npx skills add https://github.com/prapanch/agent-coda --skill secrets-hygiene
Please help me install this Agent Skill. Skill: secrets-hygiene Source: https://github.com/prapanch/agent-coda/tree/main/secops/secrets-hygiene Command: npx skills add https://github.com/prapanch/agent-coda --skill secrets-hygiene
Secrets hygiene prevents API keys, tokens, and passwords from leaking into code, logs, CI output, container images, or incident evidence, which otherwise leads to real compromise and costly incident response.
Use case: A team needs to roll over database credentials used across multiple services after a suspected exposure, while also ensuring future commits and CI logs cannot reintroduce the same class of leak.
Use the secrets-hygiene skill to design a secret storage and rotation plan for your CI/CD pipelines and application services while adding automated secret detection to prevent accidental commits.
High-intent search queries and answers about installing and using this skill.
Secret leak prevention requires establishing pre-commit repository safeguards using automated scanning, alongside strict logging sanitization practices that redact sensitive values from CI outputs and application errors before they are recorded.
Credential rotation after exposure requires an incident-ready checklist that generates new secrets, updates consumer services, revokes old credentials, and audits unauthorized usage to ensure secure recovery across the entire CI/CD delivery workflow.
Secret storage discipline involves choosing secure storage from HSMs and secret managers down to encrypted local files. You must choose a storage tier that matches your application's security requirements while always avoiding hardcoding secrets directly in code.
Pre-commit scanning tools like git-secrets, gitleaks, and trufflehog are used to establish repository safeguards that automatically detect and block accidental secret commits before they enter your source control history.
Redaction of sensitive values works by establishing logging and sanitization practices that actively intercept and mask secrets, stopping them from appearing in application outputs, incident evidence, and error messages during runtime.
arbazkhan971Detect exposed secrets and rotate credentials into secret managers.
DuqueOMDetect leaked credentials in repositories, logs, or artifacts and initiate incident response.
Division6066Configure secure credential handling for CI/CD pipelines with Vault and AWS Secrets Manager.
vertivolatamAutomate container security with image scanning, runtime monitoring, and image signing.
