detecting-secrets

name	detecting-secrets
description	Detect hardcoded secrets, API keys, tokens, and credentials in code and git history. Use when auditing for leaked secrets or before publishing code.
compatibility	Designed for Claude Code
metadata	{"allowed-tools":"Read, Grep, Glob, Bash","argument-hint":["file-or-directory"],"stability":"stable"}

Secrets and Credential Detection

Scope: $ARGUMENTS

When to Use

• Pre-publish audit (open-sourcing, npm publish, Docker push)
• Reviewing PRs for accidental credential commits
• Periodic security sweep
• Post-incident secret rotation verification

Workflow

1. Scan files for secret patterns (see detection rules)
2. Check configuration files (.env, config, YAML, JSON)
3. Inspect git history for previously committed secrets
4. Classify findings by type and severity
5. Recommend remediation (rotate, revoke, remove)

Detection Patterns

API Keys and Tokens

• AWS access keys (AKIA[0-9A-Z]{16})
• AWS secret keys ([0-9a-zA-Z/+]{40} near AWS context)
• GCP service account keys (JSON with "type": "service_account")
• GCP API keys (AIza[0-9A-Za-z_-]{35})
• Azure connection strings (DefaultEndpointsProtocol=)
• GitHub tokens (ghp_, gho_, ghu_, ghs_, ghr_)
• GitLab tokens (glpat-)
• Slack tokens (xoxb-, xoxp-, xoxs-)
• Stripe keys (sk_live_, pk_live_, rk_live_)
• Generic API key patterns (api[_-]?key, apikey, api[_-]?secret)

Private Keys

• RSA private keys (-----BEGIN RSA PRIVATE KEY-----)
• EC private keys (-----BEGIN EC PRIVATE KEY-----)
• OpenSSH private keys (-----BEGIN OPENSSH PRIVATE KEY-----)
• PGP private keys (-----BEGIN PGP PRIVATE KEY BLOCK-----)
• PKCS8 keys (-----BEGIN PRIVATE KEY-----)

Passwords and Credentials

• Hardcoded passwords (password\s*=\s*["'][^"']+["'])
• Database connection strings with credentials (://user:pass@)
• JDBC URLs with passwords
• .env files with secrets committed to repo
• .netrc / .pgpass / .my.cnf with credentials

JWT and Session Secrets

• JWT signing secrets in code (jwt.sign, JWT_SECRET)
• Session secrets (SESSION_SECRET, SECRET_KEY)
• Cookie signing keys
• Encryption keys in plaintext

High-Risk File Patterns

Prioritize scanning these locations:

• .env, .env.* (should be gitignored)
• config/, settings/, secrets/
• docker-compose*.yml (environment sections)
• *.tfvars, terraform.tfstate
• CI configs (.github/workflows/, .gitlab-ci.yml)
• Dockerfile (ENV and ARG with secrets)

Git History Scan

Check for secrets in past commits:

• Search commit diffs for secret patterns
• Check for .env files added then removed
• Look for reverted commits that contained secrets
• Verify .gitignore covers sensitive file patterns

Note: Secrets in git history remain accessible even after removal from HEAD. If found, the secret must be rotated regardless.

Output Format

#	Type	Severity	File:Line	Pattern Match	Remediation
1	AWS Key	Critical	.env:3	AKIA...	Rotate in IAM, add to .gitignore
2	Private Key	Critical	certs/key.pem	RSA key	Remove, regenerate, gitignore
3	DB Password	High	config/db.yml:12	password: hunter2	Move to env var
4	JWT Secret	High	src/auth.js:8	SECRET = "..."	Move to env var

Severity Definitions

• Critical — Active credential that grants external access (cloud, API, DB)
• High — Secret that could enable access if combined with other info
• Medium — Internal-only credential or test/dev secret in prod path
• Low — Potential false positive or non-sensitive token pattern

Remediation Steps

For every confirmed secret:

1. Rotate — Generate new credentials immediately
2. Revoke — Invalidate the exposed credential
3. Remove — Delete from codebase and git history if needed
4. Prevent — Add pattern to .gitignore and pre-commit hooks