secret-scanner

What problem does it solve?

The Secret Scanner helps developers prevent leaking credentials by automatically detecting hardcoded API keys, passwords, tokens, and other secrets in code before they reach git. It reduces the risk of secret exposure during commits and collaboration.

Core Features & Use Cases

• Pre-commit secret detection: Scans staged changes for sensitive patterns using a Bash-based hook.
• Comprehensive pattern coverage: Detects common secret indicators such as API_KEY, SECRET, PASSWORD, TOKEN, and PRIVATE_KEY.
• Mitigation guidance: Provides steps to move secrets to environment variables and .env files, and to update .gitignore and secret management practices.

Quick Start

1. Add the PreToolUse hook as described in SKILL.md, ensuring your repository runs the secret scan on git commit.
2. Create a sample test file with a secret pattern to verify the hook blocks the commit when secrets are present.
3. Remove secrets from code, store them in environment variables, and re-run the commit test.