security-review-owasp-secrets-management

What problem does it solve?

This Skill helps reviewers find where secrets are exposed, over-shared, poorly rotated, or difficult to recover during an incident, reducing the risk of credential theft and blast-radius expansion.

Core Features & Use Cases

• Secret storage review: Checks whether credentials are centralized, encrypted, and protected from plaintext exposure in repositories, configs, images, and backups.
• Access and lifecycle analysis: Evaluates least-privilege access, rotation, revocation, expiration, and ownership for API keys, tokens, database passwords, TLS keys, and signing material.
• CI/CD and runtime handling: Inspects pipelines, runners, containers, and orchestrators for secret injection paths that could leak through logs, artifacts, debug access, or broad branch permissions.
• Use case: Review a deployment pipeline to confirm production secrets are injected only when needed, never echoed, and revocable quickly during a compromise.

Quick Start

Use the secrets-management skill to review the relevant code, configuration, and pipeline files for how secrets are stored, injected, rotated, logged, and revoked.