secrets-scanner

name	secrets-scanner
description	Scan codebase for secrets, API keys, credentials, and PII. Detect hardcoded sensitive data. Use when auditing for secrets, checking for exposed keys, reviewing security, or scanning for PII.
allowed-tools	Read, Grep, Glob

Secrets Scanner

Detects hardcoded secrets and sensitive data in the codebase.

When to Use

• "Scan for secrets"
• "Check for API keys"
• "Audit for credentials"
• "Find hardcoded passwords"
• "PII scan"

What to Detect

High Priority (Block Merge)

Type	Pattern	Example
API Keys	[a-zA-Z0-9_-]{32,}	OpenAI, Anthropic, etc.
AWS Credentials	AKIA[A-Z0-9]{16}	AKIAIOSFODNN7EXAMPLE
Private Keys	-----BEGIN.*PRIVATE KEY-----	RSA, SSH keys
JWT Secrets	jwt.*=.*['"][a-zA-Z0-9+/=]{20,}	Signing secrets
Database URLs	postgres://.*:.*@	With password
Bearer Tokens	Bearer [a-zA-Z0-9._-]+	Hardcoded tokens

Medium Priority (Review)

Type	Pattern
Generic secrets	secret.*=.*['"]
Passwords	password.*=.*['"]
Tokens	token.*=.*['"]
API keys	api[_-]?key.*=.*['"]

PII Patterns

Type	Pattern
Email addresses	[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}
Phone numbers	\+?1?[-.\s]?\(?[0-9]{3}\)?[-.\s]?[0-9]{3}[-.\s]?[0-9]{4}
SSN	\d{3}-\d{2}-\d{4}
Credit cards	\d{4}[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4}

Allowed Exceptions

These files are expected to have secret-like patterns:

• .env.example - Template placeholders only
• *.test.ts - Test fixtures
• Documentation files - Examples only

Procedure

Step 1: Scan for API Keys

Grep: (OPENAI_API_KEY|ANTHROPIC_API_KEY|sk-[a-zA-Z0-9]{32,})
Exclude: .env.example, *.md, node_modules

Step 2: Scan for Credentials

Grep: (password|secret|credential|token)\s*[:=]\s*['"][^'"]+['"]
Exclude: .env.example, node_modules

Step 3: Scan for Private Keys

Grep: -----BEGIN.*PRIVATE KEY-----

Step 4: Scan for Database URLs

Grep: (postgres|mysql|mongodb)://[^:]+:[^@]+@
Exclude: .env.example, docker-compose.yml

Step 5: Check .env Files

Glob: **/.env*
Read: Each file (except .env.example)

Ensure .env is in .gitignore.

Step 6: Generate Report

## Secrets Scan Report

### 🔴 Critical Findings

{List of actual secrets found with file:line}

### 🟡 Suspicious Patterns

{Patterns that look like secrets but may be false positives}

### ✅ Verified Safe

- .env.example contains only placeholders
- Test files use mock values
- .gitignore excludes .env files

### Recommendations

{Actions to take}

False Positive Handling

Common false positives:

• Example values in docs: sk-example-key-123
• Test fixtures: test-token-abc
• Environment variable names: OPENAI_API_KEY=
• Base64 encoded data (non-secret)

Verify by checking:

1. Is it in a test/example file?
2. Does it match real credential format?
3. Is it actually used in production code?

Guardrails

• DO NOT expose found secrets in output (truncate)
• DO NOT assume patterns are secrets without verification
• ALWAYS check .gitignore for .env exclusion
• Report findings privately (not in PR comments)
• Recommend credential rotation if secrets found in history