// Quick scan for leaked secrets — API keys, passwords, tokens, database URLs. Use when the user wants to check for hardcoded secrets or exposed credentials.
Install ship-safe as real-time Claude Code hooks — blocks secrets and dangerous commands before they land on disk. Use when the user wants automatic security scanning on every file write or bash command.
Manage your security baseline — accept current findings as known debt, then only report new regressions on future scans. Use when the user wants to adopt security scanning incrementally or suppress existing findings.
Run Ship Safe in CI mode — compact output, exit codes, SARIF generation. Use when the user wants to set up CI/CD security gates or test their pipeline configuration.
Run a deep security audit with LLM-powered taint analysis — regex scan nominates findings, then an LLM verifies taint reachability and exploitability. Use when the user wants thorough, high-confidence results with fewer false positives.
Auto-fix security issues — remediate hardcoded secrets and common vulnerabilities (TLS bypass, debug mode, XSS, shell injection, Docker :latest). Use when the user wants to automatically fix security findings.
Run a multi-agent red team scan — 16 specialized security agents scan for 80+ attack classes including injection, auth bypass, SSRF, supply chain, Supabase RLS, MCP security, agentic AI, RAG poisoning, PII compliance, and more. Use when the user wants a deep security analysis beyond just secrets.
| name | ship-safe-scan |
| description | Quick scan for leaked secrets — API keys, passwords, tokens, database URLs. Use when the user wants to check for hardcoded secrets or exposed credentials. |
| argument-hint | [path] |
You are scanning this project for leaked secrets using Ship Safe's pattern matching and entropy analysis engine.
npx ship-safe@latest scan $ARGUMENTS --json 2>/dev/null
If $ARGUMENTS is empty, default to .:
npx ship-safe@latest scan . --json 2>/dev/null
The command exits 0 if clean, 1 if secrets found. Capture stdout regardless.
The JSON output has this structure:
{
"filesScanned": 234,
"totalFindings": 5,
"clean": false,
"findings": [
{
"file": "src/config.js",
"findings": [
{
"line": 42,
"type": "Stripe Live Secret Key",
"severity": "critical",
"description": "Hardcoded Stripe live secret key found",
"matched": "sk_live_****"
}
]
}
]
}
If clean: Confirm no secrets were found. Report how many files were scanned. This is good news!
If secrets found:
For each secret found, offer to fix it:
Replace the hardcoded secret with an environment variable reference:
process.env.VARIABLE_NAMEos.environ.get('VARIABLE_NAME')STRIPE_SECRET_KEY, DATABASE_URL)Create or update .env.example with placeholder values:
STRIPE_SECRET_KEY=sk_live_your_key_here
DATABASE_URL=postgresql://user:password@host:5432/db
Ensure .env is in .gitignore — check and add if missing
Warn about git history — if the secret was already committed, it exists in git history. Recommend:
npx ship-safe rotate)git filter-branch or BFG Repo Cleaner to remove from historySuggest auto-fix — mention /ship-safe-fix for bulk remediation, or /ship-safe-baseline to baseline known findings
Read the file and surrounding context before making any changes. Apply fixes only after presenting the findings, unless the user asked for auto-fix.