security-secrets

To scan a code repository for hardcoded secrets, this Skill executes ripgrep, gitleaks, semgrep, and trufflehog. It identifies high-signal patterns and prioritizes common secret-containing files like .env and private keys to detect potential data exfiltration vectors.

The best way to detect sensitive secrets in .env files is using automated scanning tools that prioritize these specific files. This Skill checks .env and private key files using regex patterns to find high-risk AWS keys and GitHub tokens.

Yes, you can use gitleaks and trufflehog together for comprehensive secret detection. This Skill runs both tools alongside ripgrep and semgrep to scan code and history, ensuring proactive security auditing and mitigating data breach risks.

No, this secret scanning approach requires external dependencies to function. The Skill executes scanning scripts that rely on having ripgrep, gitleaks, semgrep, and trufflehog installed in the environment to detect hardcoded credentials.

You should run a secrets scan before committing code to prevent accidental credential exposure. Executing this Skill identifies accidentally included API keys or database credentials, mitigating security risks and preventing a potential data breach.