secret-scanner
Detect exposed secrets, API keys, credentials, and tokens in code. Use before commits, on file saves, or when security is mentioned. Prevents accidental secret exposure. Triggers on file changes, git commits, security checks, .env file modifications.
Security Assessment
Detected risks:
About secret-scanner
The secret-scanner skill helps developers and security teams prevent the accidental exposure of sensitive information such as API keys, credentials, tokens, and other secrets within source code. By integrating with common development workflows, this tool scans for secrets in real time during key events like git commits, file modifications, and .env file updates. It ensures that sensitive data is not inadvertently shared, which could otherwise lead to serious security vulnerabilities and potential breaches in applications or services.
FAQ
How does the secret-scanner skill work?
The skill scans your code for exposed secrets whenever a file is modified or saved, a git commit is made, or a .env file is changed. It alerts you when sensitive information like API keys, database credentials, and private keys are found, suggesting fixes such as moving secrets to environment variables.
Is secret-scanner compatible with all programming languages?
While the skill can detect a wide variety of secret types, its effectiveness largely depends on the language and context. It supports popular environments like JavaScript, Python, and YAML, and is particularly useful for projects that utilize git for version control.
What happens if secret-scanner detects a secret?
The skill will immediately alert you about the exposed secret, specifying the file and line number where the secret was found. It will also suggest corrective actions, such as replacing hardcoded values with environment variables and updating your .gitignore to prevent accidental commits.
Does the secret-scanner skill block commits?
Yes, if secrets are detected before a commit, it will block the commit to prevent sensitive data from being pushed to the repository. You will need to resolve the issues before proceeding with the commit.
Can I trust the skill to handle all secrets?
While the skill uses high-confidence patterns for detecting secrets, false positives can occasionally occur. It's always a good idea to review flagged entries, particularly in test files or documentation.
Install secret-scanner
Quick Setup:
- Copy the skill folder to
.claude/skills/ - Claude will automatically detect and use the skill
Repository
alirezarezvani/claude-code-tresor