secrets-identity-hardener

What problem does it solve?

This Skill hardens an application’s secret and identity handling when credentials are hardcoded, committed, exposed in client bundles, or spread across unclear environment-variable boundaries. It helps move sensitive values into safer runtime storage, reduce privilege, and prove that secrets are no longer reachable from the browser.

Core Features & Use Cases

• Secret inventory and classification: Distinguish public, server-only, CI-only, and deploy-only variables so exposure risks are explicit.
• Client-bundle exposure checks: Verify the built frontend does not contain server secrets, especially when bundler prefixes like VITE_ or NEXT_PUBLIC_ are involved.
• Rotation and revocation guidance: Plan and validate credential rotation for leaked or overexposed secrets, including service-account scope reduction and session/token hardening.
• Use Case: A frontend repo contains committed .env files and a database credential in client-visible config; this Skill helps relocate the secret, prove it is absent from the shipped bundle, and document the rotation path.

Quick Start

Use the secrets-identity-hardener skill to classify exposed variables, move server-only secrets out of the client, and verify the built bundle no longer leaks them.