/secrets-scan
Find what shouldn't be in the codebase.
Usage
/secrets-scan # current working tree
/secrets-scan --history # also scan git history (slow)
/secrets-scan --staged # only what's about to be committed
Patterns detected
- AWS:
AKIA[0-9A-Z]{16},aws_secret_access_key=... - GCP: service account JSON keys
- Azure: connection strings, SAS tokens
- GitHub:
ghp_...,gho_...,ghu_... - OpenAI / Anthropic:
sk-...,sk-ant-... - Stripe:
sk_live_...,rk_live_... - Slack:
xoxb-...,xoxp-... - JWT: standalone
eyJ...strings - Generic: high-entropy strings inside quoted values
- Private keys:
-----BEGIN (RSA|EC|OPENSSH|PGP) PRIVATE KEY-----
What to do when found
- Report the file:line with the masked value (
sk-...XYZ) - Do NOT echo the full secret in any output
- Suggest:
- Move to env var
- If pushed to remote: rotate immediately + provide rotation links per provider
- Add to
.gitignoreif it's a config file
Rules
- Skip
node_modules,.next, build artifacts - Suppress matches in test fixtures clearly named (
*-mock.json,*.example) - If
--historyfinds a secret in past commits, recommend BOTHgit filter-repoAND credential rotation (filtering alone doesn't help if it was already pushed)