signalproof-secrets

Trace where each secret originates, where it is stored, and where it may be copied, then inspect source control, config files, environment files, logs, and fixtures. Classify each finding as confirmed, potential, or not exposed before containing it.

Treat a confirmed exposure as evidence requiring containment: stop further logging, preserve redacted evidence, and recommend rotation. Do not assume deleting the log entry makes the credential safe, and do not rotate without proper authority.

No. It recommends rotation or revocation only when appropriate, but actual rotation requires explicit authority because it may affect dependent systems. It never performs externally consequential credential changes silently.

Preserve redacted evidence sufficient to prove the finding, such as file paths, line references, and masked value fragments. Avoid printing or copying full secret values into reports, tickets, or chat logs.

Stop when continuing would require exposing a full credential unnecessarily, using a credential outside your authority, publishing secret-bearing evidence, or deleting the only evidence needed to prove an exposure before it is preserved.