sui-security-guard

name

sui-security-guard

description

Use when setting up security scanning, detecting leaked secrets/API keys, implementing pre-commit hooks, or auditing a Sui Move contract for security/architecture/quality issues. Triggers on "security scan", "detect secrets", "pre-commit hook", "security audit setup", "API key leaked", and on contract-level review requests like "audit this contract", "review access control", "is this Move safe", "check for vulnerabilities", "Move security review" — these load the SEC/DES/PAT/TST/QA/CFG finding registry in references/move-security-findings.md. For offensive/adversarial testing (attack vector discovery, writing exploits/PoCs), use sui-red-team instead. For Move style/idiom quality (non-security), use move-code-quality.

SUI Security Guard

Secret detection and pre-commit hooks for SUI projects.

Secret Detection

Scan the project for leaked secrets using grep patterns:

# SUI private keys
grep -rn 'suiprivkey1[a-zA-Z0-9]\{44\}' --include='*.ts' --include='*.move' --include='*.json' .

# Mnemonics (12+ word phrases that look like BIP39)
grep -rn '\b\(abandon\|ability\|able\|about\|above\)' --include='*.ts' --include='*.env' .

# API keys
grep -rn 'sk-[a-zA-Z0-9]\{20,\}\|sk-ant-[a-zA-Z0-9-]\{20,\}' .

# AWS credentials
grep -rn 'AKIA[A-Z0-9]\{16\}' .

# .env files that shouldn't be committed
git ls-files '*.env' '.env*'

If any matches are found: rotate the key immediately, then use git-filter-repo or BFG Repo-Cleaner to purge from git history.

Pre-commit Hook Setup

Create .git/hooks/pre-commit to block secrets before they enter git:

#!/bin/sh
# Scan staged files for secrets before committing

STAGED=$(git diff --cached --name-only --diff-filter=ACM)

# Check for SUI private keys
if echo "$STAGED" | xargs grep -l 'suiprivkey1' 2>/dev/null; then
  echo "❌ SUI private key detected in staged files. Commit blocked."
  exit 1
fi

# Check for .env files
if echo "$STAGED" | grep -q '\.env$\|\.env\.'; then
  echo "❌ .env file staged for commit. Add to .gitignore."
  exit 1
fi

# Check for common API key patterns
if echo "$STAGED" | xargs grep -l 'sk-[a-zA-Z0-9]\{20,\}' 2>/dev/null; then
  echo "❌ API key pattern detected. Commit blocked."
  exit 1
fi

echo "✅ Security scan passed."

# Install the hook
chmod +x .git/hooks/pre-commit

For team-wide enforcement, use a shared hooks directory:

git config core.hooksPath .githooks/
# Then commit .githooks/pre-commit to the repo

.gitignore Essentials

Ensure these are in .gitignore:

.env
.env.*
!.env.example
*.pem
*.key

Security Checklist

Before deployment, verify:

• No hardcoded private keys or mnemonics in source
• .env files in .gitignore
• No API keys in frontend code (browser-accessible)
• AdminCap / UpgradeCap properly guarded (not public transfer)
• Pre-commit hook installed and active

Move Contract Audit (deep review)

For a structured security/architecture review of Move source — beyond secret scanning — use references/move-security-findings.md: a 40-check finding registry (SEC / DES / PAT / TST / QA / CFG) with S1–S4 severities and a 6-phase workflow, distilled from MystenLabs' Move-code-review skill. Load it when the task is "audit this contract", "review access control", "is this Move safe", or any contract-level security analysis. Supports scoped reviews — report only the requested ID prefixes.

Integration

• Called by: sui-full-stack (throughout development)
• For deep Move-contract auditing, use references/move-security-findings.md (above)
• For offensive/adversarial testing (attack vectors, exploits), use sui-red-team
• For code quality / Move style best practices, use move-code-quality