supply-chain-secrets

Detect hardcoded secrets by scanning source code, configuration files, and infrastructure-as-code templates using passive pattern matching and fingerprinting to identify exposed API keys, private keys, and connection strings securely without validating against live services.

Credential leakage in Git history occurs when sensitive tokens are committed to repositories. Scan local filesystems and Git history to detect exposed credentials using pattern matching and metadata inspection, ensuring secure, non-destructive security auditing across the entire repository.

Yes, you can scan infrastructure-as-code templates for accidentally committed API keys and database credentials. The skill operates across local filesystems and Git history to detect exposure before pushing to shared environments, mitigating critical security risks.

Secret detection does not validate found credentials against live services. It implements passive pattern matching and fingerprinting to ensure secure, non-destructive security auditing, identifying hardcoded credentials without risking active authentication or triggering external service alerts.

The best way to triage credential exposure is through a structured process that classifies findings by severity and guides users through secure rotation workflows. This mitigates risk by addressing accidentally committed AWS access keys or database credentials systematically.