| name | scanning-for-hardcoded-secrets |
| description | Scan a source-code tree for hardcoded credentials embedded in source
files: AWS access keys, GitHub tokens, Stripe keys, Slack tokens,
Anthropic API keys, OpenAI keys, JWT signing secrets, generic
base64-encoded passwords, RSA / SSH private keys, and high-entropy
string literals that pattern-match common credential shapes.
Use when: pre-commit gate before pushing a feature branch, audit
before SOC2, post-incident scan after a leak, or inheriting a
codebase you didn't write.
Threshold: any source file contains a string that matches a
canonical credential regex (AWS AKIA prefix, GitHub ghp_ prefix,
etc.) OR a string with Shannon entropy above 4.5 in a field
context (key=, token:, secret=).
Trigger with: "scan secrets", "credential scan", "find hardcoded
keys", "leak check".
|
| allowed-tools | ["Read","Bash(python3:*)","Glob","Grep"] |
| disallowed-tools | ["Bash(rm:*)","Bash(curl:*)","Bash(wget:*)","Write(.env)","Edit(.env)"] |
| version | 3.30.0 |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| license | MIT |
| compatibility | Designed for Claude Code |
| tags | ["security","static-analysis","secrets","pentest"] |
Scanning for Hardcoded Secrets
Overview
The single most common cause of credential breach in 2026 remains
hardcoded secrets in source code. Engineers paste an API key into a
config file "just for testing," forget to remove it, commit the
file. The credential is now in the repository's history forever
(git rebase doesn't help if anyone cloned in between) and
extractable by anyone who reaches the repo: contractors,
ex-employees, attackers via .git/ directory exposure (see skill
six), GitHub bot scrapers crawling public repos.
The cost of detection-after-commit is near-zero (free tools exist:
gitleaks, trufflehog, this skill). The cost of detection-before-commit
is also near-zero (pre-commit hooks). The cost of remediation after
the fact is rotating every credential exposed + auditing for
exploitation + potentially notifying customers of breach. The
asymmetry is severe, the discipline is the only constraint.
This skill scans a filesystem tree, matching against a canonical
regex library covering the credential shapes attackers and bots
search for first.
When the skill produces findings
| Finding | Severity | Threshold | Affected control |
|---|
| AWS access key (AKIA-prefix) | CRITICAL | Literal AKIA[0-9A-Z]{16} in any file | CWE-798 |
| AWS secret access key | CRITICAL | 40-char base64 in aws_secret_access_key field context | CWE-798 |
| GitHub personal access token | CRITICAL | ghp_[A-Za-z0-9]{36} or gho_, ghu_, ghs_, ghr_ | CWE-798 |
| GitHub app installation token | CRITICAL | ghs_[A-Za-z0-9]{36} | CWE-798 |
| Stripe live key | CRITICAL | sk_live_[A-Za-z0-9]{24,} | CWE-798 |
| Stripe test key | MEDIUM | sk_test_[A-Za-z0-9]{24,} | CWE-798 |
| Anthropic API key | CRITICAL | or similar |
