Secret Scanning Reference

Purpose

Detect hardcoded secrets, API keys, credentials, and sensitive tokens in source code and git history. Secrets in code are among the most common and highest-impact findings in real-world penetration tests.

When to Use

Activate this skill during:

• Initial code review phase to find low-hanging fruit
• Git history analysis for rotated but exposed credentials
• .env and configuration file review
• CI/CD pipeline security assessment

High-Value Secret Patterns

API Keys & Tokens

Private Keys & Certificates

Database Credentials

JWT & Session Secrets

Methodology

Step 1: Source Code Scanning

Search for secrets in the current codebase:

# AWS keys
grep -rniE "AKIA[0-9A-Z]{16}" --include="*.py" --include="*.js" --include="*.ts" --include="*.java" --include="*.go" --include="*.rb" --include="*.php"

# Private keys
grep -rn "BEGIN.*PRIVATE KEY" --include="*.pem" --include="*.key" --include="*.py" --include="*.js" --include="*.env"

# Connection strings with passwords
grep -rniE "(postgres|mysql|mongodb|redis)://[^:]+:[^@\s]+@" .

# Generic password/secret assignments
grep -rniE "(password|passwd|secret|api_key|apikey|access_token|auth_token)\s*[:=]\s*[\"'][^\"']{8,}" .

# .env files (often contain secrets)
find . -name ".env*" -not -path "*/node_modules/*" -not -path "*/.git/*" 2>/dev/null

Step 2: Git History Scanning

Secrets may have been committed and later removed but remain in git history.

Using gitleaks (recommended):

gitleaks detect --source . --report-format json --report-path /tmp/gitleaks-results.json

Using truffleHog:

trufflehog filesystem . --json > /tmp/trufflehog-results.json

Manual git history search:

# Search for high-entropy strings in git history
git log -p --all -S "AKIA" -- . | head -100
git log -p --all -S "BEGIN RSA PRIVATE" -- . | head -100
git log -p --all -S "sk_live_" -- . | head -100

Step 3: Configuration File Review

Check for secrets in configuration:

# Environment files
cat .env .env.local .env.production 2>/dev/null

# Docker compose secrets
grep -rniE "(password|secret|key|token)" docker-compose*.yml 2>/dev/null

# Kubernetes secrets (base64-encoded)
grep -rniE "data:" -A5 --include="*.yaml" --include="*.yml" | grep -v "^--$"

# CI/CD pipeline files
cat .github/workflows/*.yml .gitlab-ci.yml Jenkinsfile 2>/dev/null | grep -iE "(secret|password|token|key)"

Step 4: Per-Language Hardcoded Credentials

Python:

grep -rniE "(os\.environ\.get|os\.getenv)\([\"'][^\"']+[\"'],\s*[\"'][^\"']{8,}" --include="*.py"
grep -rniE "password\s*=\s*[\"'][^\"']{4,}" --include="*.py"

JavaScript/TypeScript:

grep -rniE "process\.env\.\w+\s*\|\|\s*[\"'][^\"']{8,}" --include="*.js" --include="*.ts"
grep -rniE "const\s+\w*(secret|key|password|token)\w*\s*=\s*[\"']" --include="*.js" --include="*.ts"

Java:

grep -rniE "String\s+\w*(password|secret|key)\w*\s*=\s*\"" --include="*.java"
grep -rniE "\.setPassword\(\"[^\"]+\"\)" --include="*.java"

Go:

grep -rniE "(password|secret|apiKey|token)\s*[:=]\s*\"[^\"]{8,}" --include="*.go"

Step 5: Classify and Report

For each secret found, determine:

Severity mapping:

• CRITICAL: Production credentials, cloud provider keys, database passwords
• HIGH: API keys with write access, JWT signing secrets
• MEDIUM: Read-only API keys, development credentials in non-dev branches
• LOW: Expired/rotated secrets, test/example credentials

False Positive Indicators

• Example/placeholder values: YOUR_API_KEY_HERE, changeme, xxxx, dummy
• Test fixtures with fake credentials
• Documentation showing credential format
• Base64-encoded non-secret data (e.g., certificates vs private keys)
• Environment variable references without default values: os.environ["KEY"] (no hardcoded fallback)

Integration with Findings Artifact

Map results to .claude/findings.json with:

• type: "hardcoded-secret"
• kind: "finding" (secrets are always reportable, not hotspots)
• source_tool: "gitleaks", "trufflehog", or "manual"
• evidence: Include the file, line, and a redacted excerpt (mask all but first 4 and last 4 characters)

Integration with Other Skills

• Use dangerous-functions skill to find credential-handling code paths
• Use security-misconfiguration skill for exposed admin panels and debug endpoints
• Use logging-failures skill to check if secrets are leaked in log output
• Use sensitive-data-leakage skill for broader data exposure patterns