secrets-hygiene

What problem does it solve?

Secrets hygiene prevents API keys, tokens, and passwords from leaking into code, logs, CI output, container images, or incident evidence, which otherwise leads to real compromise and costly incident response.

Core Features & Use Cases

• Secret storage discipline: Choose secure secret storage from HSMs and secret managers down to encrypted local files, and avoid hardcoding secrets in code.
• Leak prevention controls: Establish pre-commit and repository safeguards (e.g., git-secrets, gitleaks, trufflehog) plus logging and sanitization practices that stop secrets from appearing in outputs.
• Incident-ready rotation: Execute a rotation checklist that generates new secrets, updates consumers, revokes old credentials, and audits for unauthorized usage.

Use case: A team needs to roll over database credentials used across multiple services after a suspected exposure, while also ensuring future commits and CI logs cannot reintroduce the same class of leak.

Quick Start

Use the secrets-hygiene skill to design a secret storage and rotation plan for your CI/CD pipelines and application services while adding automated secret detection to prevent accidental commits.