secret-scanner

name	secret-scanner
description	Grep the fleet for leaked API keys, tokens, .env files in git history, and accidentally committed secrets. Cites real patterns: `gh api` to find secrets in repo blobs, `git log -p` to find secrets in history, common false positives (test fixtures, example configs). Use before any major fleet work — the audit often surfaces secrets in archived repos that the user forgot existed.

Secret Scanner

Find accidentally committed secrets across a fleet. Use this skill before any fleet-wide operation — the audit often reveals secrets in repos the user forgot about.

What to look for

Pattern	Risk	Example
.env files committed	CRITICAL	Production database URLs, API keys
AWS access keys (AKIA[0-9A-Z]{16})	CRITICAL	Cloud account access
GitHub PATs (ghp_[a-zA-Z0-9]{36})	CRITICAL	Repo write access
Stripe keys (sk_live_[a-zA-Z0-9]{24,})	CRITICAL	Payment system access
Slack tokens (xox[abp]-[a-zA-Z0-9-]+)	HIGH	Workspace access
Private keys (-----BEGIN [A-Z ]+PRIVATE KEY-----)	CRITICAL	SSH/cert access
Hardcoded API keys in source	HIGH	Third-party service compromise
.npmrc with _authToken	MEDIUM	npm publish access

Fleet-wide scan

# For each repo, scan the default branch
for repo in $(gh repo list --limit 200 --no-archived --json name -q . | jq -r '.[]'); do
    echo "=== $repo ==="
    gh api repos/camster91/$repo/contents/.env 2>/dev/null && echo "  HAS .env"
    gh api repos/camster91/$repo/contents/.env.local 2>/dev/null && echo "  HAS .env.local"
    gh api repos/camster91/$repo/git/trees/main?recursive=1 2>/dev/null | \
        jq -r '.tree[] | select(.path | test("\\.env(\\.|$)")) | .path' | \
        head -5
done

History scan (catches secrets that were deleted)

# Clone and grep all history
git clone https://github.com/camster91/<repo>.git /tmp/<repo>-secretscan
cd /tmp/<repo>-secretscan
git log -p --all | grep -E "(AKIA[0-9A-Z]{16}|sk_live_|ghp_[a-zA-Z0-9]{36}|-----BEGIN.*PRIVATE KEY-----)" | head -20

This catches secrets that were in a file at some point but later removed (the file's gone, but the commit history still has it).

Common false positives

• test/fixtures/example.env with placeholder values
• docs/getting-started.md with sk_test_xxx showing Stripe test keys
• .env.example files (these are SUPPOSED to exist — they're templates)
• Public test API keys (Stripe publishes these intentionally)

Always manually verify before flagging.

Response

If you find a leaked secret:

1. Don't paste it in the report — redact
2. Tell the user to rotate the key at the source (Stripe dashboard, AWS IAM, GitHub PAT settings)
3. Then commit a removal of the secret from git history (git filter-repo or BFG)
4. Add the secret pattern to .gitignore to prevent recurrence

Related Skills & Chains

• fleet-ci-audit — Use this first to get a list of all active repos, then run secret scan on them
• user-pasted-secrets — If the user pastes a secret in chat, use this skill to handle it safely