secrets-scan

Scan codebases and Git history for exposed secrets using Gitleaks and TruffleHog.

1|Updated Jan 26, 2026

Search Tags:#security #secrets #credentials #api keys #git history #code scanning

Ready to run

npx skills add https://github.com/manastalukdar/claude-devstudio --skill secrets-scan-manastalukdar

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: secrets-scan
Source: https://github.com/manastalukdar/claude-devstudio/tree/main/skills/secrets-scan
Command: npx skills add https://github.com/manastalukdar/claude-devstudio --skill secrets-scan-manastalukdar

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill proactively scans your codebase and Git history to detect and report exposed secrets, credentials, and sensitive information, preventing potential security breaches.

Core Features & Use Cases

Codebase Scanning: Identifies secrets within current files using pattern matching and advanced tools.
Git History Analysis: Scans past commits to find accidentally leaked credentials.
Remediation Guidance: Provides clear steps to revoke secrets and prevent future leaks.
Use Case: Before committing code, run this Skill to ensure no API keys or passwords are accidentally included, safeguarding your project from unauthorized access.

Quick Start

Run /secrets-scan to scan your current codebase for exposed secrets.

Frequently Asked Questions about secrets-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan my codebase for exposed API keys and credentials?▼

You can scan your codebase for exposed secrets by running pattern matching and specialized tools like Gitleaks, TruffleHog, and detect-secrets. This process identifies accidentally included API keys and passwords in your current files before committing code.

Can I check Git history for accidentally leaked secrets and passwords?▼

Yes, you can check Git history for accidentally leaked secrets by scanning past commits. This Skill analyzes your commit history to find credentials that may have been pushed previously, helping you identify and remediate historical security breaches.

Do I need Gitleaks or TruffleHog installed to detect sensitive information in my repository?▼

Gitleaks, TruffleHog, and detect-secrets are optional external tools that enhance comprehensive analysis. The Skill requires Bash scripting and Git as foundational dependencies, while these specialized tools provide advanced pattern matching capabilities for deeper remediation guidance.

What is the best way to find exposed credentials in software development workflows?▼

The best way to find exposed credentials in software development workflows is to proactively scan both your current codebase and Git history. Using pattern matching alongside tools like Gitleaks detects sensitive information before it causes unauthorized access or security breaches.

What should I do after finding leaked API keys in my Git history?▼

After finding leaked API keys in your Git history, you should follow the provided remediation guidance to revoke the exposed secrets. This Skill offers clear steps to revoke credentials and prevent future accidental leaks in your development workflow.