skills.rest
FluxonLab
FluxonLabCOMMUNITY
Explore all skills by this author →
Website𝕏@fluxonlabGitHub

security-and-secrets-review

Review codebases for committed secrets, auth flaws, CORS misconfigurations, and logging leaks.

2|Updated Jun 1, 2026
Search Tags:#jwt#security review#git history#cors#credential rotation#secret scanning#env hardening
One-click install
npx skills add https://github.com/FluxonLab/Skillry --skill security-and-secrets-review-fluxonlab
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-and-secrets-review
Source: https://github.com/FluxonLab/Skillry/tree/main/plugins/security/skills/47-security-and-secrets-review
Command: npx skills add https://github.com/FluxonLab/Skillry --skill security-and-secrets-review-fluxonlab

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Secrets, tokens, and misconfigured security controls slip into codebases through committed .env files, hardcoded fallback credentials, permissive CORS policies, and unredacted logging. This Skill performs an evidence-driven security review that finds these issues, ranks them by severity, and produces concrete fixes with rotation flags for any live exposed secret. ## Core Features & Use Cases - Committed-secret scanning: Detect provider keys (AWS, Stripe, GitHub, OpenAI), private keys, and credential assignments in the working tree and git history, with all evidence redacted to first/last 4 characters. - Auth, CORS, and transport review: Verify JWT signing and verification, token storage (httpOnly cookies vs localStorage), cookie flags, origin allowlists, and TLS validation settings. - Specialized references: Deep-dive guides for env/config hardening, secret managers (Vault, AWS Secrets Manager, Kubernetes ExternalSecrets), Electron app security, Redis hardening, and intent-vs-implementation access-control audits. - Use Case: Before merging a PR that adds an authentication flow, run the review to catch a hardcoded JWT fallback secret, a credentialed CORS wildcard, and request-body logging — each reported with file:line, severity, and a concrete fix. ## Quick Start Review this repository for committed secrets, insecure token handling, CORS misconfigurations, and logging leaks, then return a severity-ranked findings table with rotation flags.

Frequently Asked Questions about security-and-secrets-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find secrets committed to a git repository?▼

Scan the working tree with regex patterns for provider key shapes like AWS AKIA keys, Stripe sk_live keys, and PEM headers using ripgrep. For history, run git log -p -S'<string>' with approval, and treat anything ever committed as compromised requiring rotation.

What should a security code review check before merging?▼

Check for tracked .env files, hardcoded fallback secrets, JWT verified with decode instead of verify, tokens in localStorage, credentialed CORS with wildcard origins, cookies missing HttpOnly/Secure/SameSite flags, and logging of request headers or bodies.

Is adding a leaked secret to .gitignore enough to fix it?▼

No. Gitignore only prevents future commits; the secret remains in git history and every existing clone. Rotate the credential at the provider first, then remove it from the working tree, and consider history rewrite only as a separate approval-gated step.

Does this review cover Electron app security?▼

Yes, a dedicated reference covers Electron in-process security: contextIsolation, sandbox, and webSecurity options, contextBridge and preload exposure, ipcMain input validation, renderer CSP, navigation restrictions, and auto-update signature verification.

What are the limitations of regex-based secret scanning?▼

Regex scans miss secrets that do not match known shapes, such as custom tokens, base64 blobs, or secrets split across lines, and a working-tree scan says nothing about history. Pair pattern scans with entropy-based tools like gitleaks or trufflehog for higher-stakes reviews.

Why is jwt.decode dangerous compared to jwt.verify?▼

jwt.decode reads the token payload without checking the signature, so anyone can forge a token and pass the check. Always use jwt.verify with an explicit algorithm allowlist and expiry validation.

Related Skills

Explore More Software Engineering Skills→
kiurakkukiurakku
15

secrets-audit

Detect exposed secrets and credentials in working trees, git history, and configuration files.

Community
Intermediate
sdcorejssdcorejs
2

sdcorejs-repair-loop

Verify, fix, and re-verify review findings until Critical and Important items resolve.

Community
Advanced
kiurakkukiurakku
15

dependency-audit

Audit dependencies for CVEs, supply-chain risks, and safe upgrade paths.

Community
Intermediate
balsm-healthbalsm-health
2

implementing-secrets-scanning-in-ci-cd

Automate hardcoded secret detection in CI/CD pipelines with gitleaks and trufflehog.

Official
Advanced