secrets-audit

Name: secrets-audit
Author: briiirussell

123installs36forks

How to install secrets-audit?

briiirussell/cybersecurity-skills/secrets-audit

$npx -y skills add briiirussell/cybersecurity-skills --skill secrets-audit

Installs into the current project.

Summary

Find leaked secrets in source code, Git history, build artifacts, and infrastructure — and audit the secrets-management posture preventing future leaks. Use when the user mentions 'secrets audit,' 'secret scanning,' 'leaked credentials,' 'API key in code,' 'gitleaks,' 'trufflehog

Files · 1

View on GitHub

SKILL.md

1	# Secrets Audit — Credential Exposure and Secrets-Management Review
2
3	Two halves: (1) find secrets that have already leaked into source, history, or artifacts, and (2) audit the secrets-management posture that determines whether future leaks happen.
4
5	Most secret leaks aren't "we forgot to redact" — they're "we never had a system, so every developer made up their own approach." This skill covers both the cleanup and the prevention.
6
7	Cross-references: `dependency-audit` (CI-related secrets risk in build-time exposure), `iam-audit` (workload identity federation as the alternative to long-lived keys), `owasp-audit` A02 (in-source secret patterns).
8
9	## Part 1 — Find leaked secrets
10
11	### Provider key prefixes (high-confidence patterns)
12
13	The most useful first sweep is grep against known provider key prefixes. False positives are low and matches are almost always real.
14
15	```bash
16	# Stripe
17	grep -rE "(sk_live_\|sk_test_\|rk_live_\|whsec_)[A-Za-z0-9]{20,}" . \
18	--include="*.{js,ts,jsx,tsx,py,rb,go,java,php,sh,env,yml,yaml,json}"
19
20	# AWS access keys
21	grep -rE "(AKIA\|ASIA)[A-Z0-9]{16}" .
22
23	# AWS secret keys (40 chars, base64-y) — high FP rate, use with caution
24	grep -rE "[A-Za-z0-9/+=]{40}" . --include=".env" --include="*.json"
25
26	# GitHub
27	grep -rE "gh[pousr]_[A-Za-z0-9]{36}" .
28
29	# Google Cloud API key + service-account JSON
30	grep -rE "AIza[A-Za-z0-9_-]{35}" .
31	grep -rln '"type": "service_account"' . --include="*.json"
32
33	# Slack
34	grep -rE "xox[baprs]-[A-Za-z0-9-]+" .
35
36	# OpenAI / Anthropic
37	grep -rE "sk-[A-Za-z0-9]{32,}" .
38	grep -rE "sk-ant-[A-Za-z0-9_-]{90,}" .
39
40	# Generic high-entropy strings in env files
41	grep -rE "^[A-Z_]+=[A-Za-z0-9/+=]{32,}$" . --include=".env"
42	```
43
44	For full repo coverage, use `git ls-files` to scope to tracked files and avoid `node_modules`:
45
46	```bash
47	git ls-files \| xargs grep -lE 'sk_live_\|ghp_\|AKIA[A-Z0-9]{16}\|sk-ant-\|AIza[A-Za-z0-9_-]{35}' 2>/dev/null
48	```
49
50	### Tooling
51
52	\| Tool \| Use \|
53	\|---\|---\|
54	\| `gitleaks detect` \| Fast, low FP, run as pre-commit and in CI; supports custom rules \|
55	\| `trufflehog git file://.` \| Verifies findings against the real API (high confidence) \|
56	\| `detect-secrets scan` \| Yelp's tool; good baseline file workflow \|
57	\| GitHub Secret Scanning \| Free for public repos; covers most providers automatically; pushes get blocked at push time when enabled with push protection \|
58	\| GitLab Secret Detection \| Similar, built-in to CI \|
59	\| GitGuardian / Doppler / Spectral \| Commercial; add organizational dashboards and historical analysis \|
60
61	### Git history (the part people forget)
62
63	A secret deleted in the latest commit is still in history — `git log -p`, `git log -S<secret>`, and any fork or local clone all have it.
64
65	```bash
66	# Search every commit for a pattern
67	git log -p -S "sk_live_" --all
68
69	# Search only deleted lines
70	git log -p --all \| grep -E "^-.*sk_live_"
71
72	# Trufflehog historical scan
73	trufflehog git file://. --since-commit=<first-commit>
74
75	# Git history rewrite — destructive, coordinate first
76	git filter-repo --invert-paths --path config/secrets.yml
77	# or
78	bfg --delete-files secrets.yml
79	```
80
81	Critical caveat: rewriting history requires every developer to re-clone, every fork is still exposed, and the secret should be considered compromised regardless. Always rotate first, history-rewrite second.
82
83	### Build artifacts and other forgotten places
84
85	Secrets leak in places that aren't `.env` files:
86
87	- Docker images — `docker history <image>` shows every `ENV` line; `--build-arg SECRET=...` ends up in layers
88	- CI environment — secrets logged by `set -x`, `console.log(process.env)`, error stack traces, debug output
89	- Frontend bundles — `NEXT_PUBLIC_` / `VITE_` / `REACT_APP_*` env vars are shipped to the browser; grep the bundled JS
90	- Crash reports — Sentry / Datadog / Bugsnag capturing `process.env` snapshots
91	- Logs — application logs shipped to a SIEM that has weaker access controls than the app
92	- Backups — `pg_dump` of a table that includes user-stored API keys
93	- Public S3 / blob storage — `.env` accidentally uploaded
94	- Documentation — README.md examples with real keys instead of placeholders
95	- Slack / Notion / Linear — pasted in a DM "to test," never rotated
96	- Browser localStorage / cookies — captured in shared screenshots or session replays
97
98	### Triaging a found secret
99
100	When you find a leaked secret:
101
102	1. Verify it's live — use the provi

briiirussellPublisher · 30 listings

Preview

briiirussell/cybersecurity-skills

# Secrets Audit — Credential Exposure and Secrets-Management Review

Two halves: (1) find secrets that have already leaked into source, history, or artifacts, and (2) audit the secrets-management posture that determines whether f

Most secret leaks aren't "we forgot to redact" — they're "we never had a system, so every developer made up their own approach." This skill covers both the clea

Cross-references: `dependency-audit` (CI-related secrets risk in build-time exposure), `iam-audit` (workload identity federation as the alternative to long-live

Repobriiirussell/cybersecurity-skills

LicenseMIT

TypeSkills

CategorySecurity

UpdatedMay 2026

Repo stars320

First seenJul 22, 2026

People who liked this also viewed

6 picks

Type

secrets-audit

123installs36forks

View on GitHub

How to install secrets-audit?

briiirussell/cybersecurity-skills/secrets-audit

$npx -y skills add briiirussell/cybersecurity-skills --skill secrets-audit

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Secrets Audit — Credential Exposure and Secrets-Management Review
2
3	Two halves: (1) find secrets that have already leaked into source, history, or artifacts, and (2) audit the secrets-management posture that determines whether future leaks happen.
4
5	Most secret leaks aren't "we forgot to redact" — they're "we never had a system, so every developer made up their own approach." This skill covers both the cleanup and the prevention.
6
7	Cross-references: `dependency-audit` (CI-related secrets risk in build-time exposure), `iam-audit` (workload identity federation as the alternative to long-lived keys), `owasp-audit` A02 (in-source secret patterns).
8
9	## Part 1 — Find leaked secrets
10
11	### Provider key prefixes (high-confidence patterns)
12
13	The most useful first sweep is grep against known provider key prefixes. False positives are low and matches are almost always real.
14
15	```bash
16	# Stripe
17	grep -rE "(sk_live_\|sk_test_\|rk_live_\|whsec_)[A-Za-z0-9]{20,}" . \
18	--include="*.{js,ts,jsx,tsx,py,rb,go,java,php,sh,env,yml,yaml,json}"
19
20	# AWS access keys
21	grep -rE "(AKIA\|ASIA)[A-Z0-9]{16}" .
22
23	# AWS secret keys (40 chars, base64-y) — high FP rate, use with caution
24	grep -rE "[A-Za-z0-9/+=]{40}" . --include=".env" --include="*.json"
25
26	# GitHub
27	grep -rE "gh[pousr]_[A-Za-z0-9]{36}" .
28
29	# Google Cloud API key + service-account JSON
30	grep -rE "AIza[A-Za-z0-9_-]{35}" .
31	grep -rln '"type": "service_account"' . --include="*.json"
32
33	# Slack
34	grep -rE "xox[baprs]-[A-Za-z0-9-]+" .
35
36	# OpenAI / Anthropic
37	grep -rE "sk-[A-Za-z0-9]{32,}" .
38	grep -rE "sk-ant-[A-Za-z0-9_-]{90,}" .
39
40	# Generic high-entropy strings in env files
41	grep -rE "^[A-Z_]+=[A-Za-z0-9/+=]{32,}$" . --include=".env"
42	```
43
44	For full repo coverage, use `git ls-files` to scope to tracked files and avoid `node_modules`:
45
46	```bash
47	git ls-files \| xargs grep -lE 'sk_live_\|ghp_\|AKIA[A-Z0-9]{16}\|sk-ant-\|AIza[A-Za-z0-9_-]{35}' 2>/dev/null
48	```
49
50	### Tooling
51
52	\| Tool \| Use \|
53	\|---\|---\|
54	\| `gitleaks detect` \| Fast, low FP, run as pre-commit and in CI; supports custom rules \|
55	\| `trufflehog git file://.` \| Verifies findings against the real API (high confidence) \|
56	\| `detect-secrets scan` \| Yelp's tool; good baseline file workflow \|
57	\| GitHub Secret Scanning \| Free for public repos; covers most providers automatically; pushes get blocked at push time when enabled with push protection \|
58	\| GitLab Secret Detection \| Similar, built-in to CI \|
59	\| GitGuardian / Doppler / Spectral \| Commercial; add organizational dashboards and historical analysis \|
60
61	### Git history (the part people forget)
62
63	A secret deleted in the latest commit is still in history — `git log -p`, `git log -S<secret>`, and any fork or local clone all have it.
64
65	```bash
66	# Search every commit for a pattern
67	git log -p -S "sk_live_" --all
68
69	# Search only deleted lines
70	git log -p --all \| grep -E "^-.*sk_live_"
71
72	# Trufflehog historical scan
73	trufflehog git file://. --since-commit=<first-commit>
74
75	# Git history rewrite — destructive, coordinate first
76	git filter-repo --invert-paths --path config/secrets.yml
77	# or
78	bfg --delete-files secrets.yml
79	```
80
81	Critical caveat: rewriting history requires every developer to re-clone, every fork is still exposed, and the secret should be considered compromised regardless. Always rotate first, history-rewrite second.
82
83	### Build artifacts and other forgotten places
84
85	Secrets leak in places that aren't `.env` files:
86
87	- Docker images — `docker history <image>` shows every `ENV` line; `--build-arg SECRET=...` ends up in layers
88	- CI environment — secrets logged by `set -x`, `console.log(process.env)`, error stack traces, debug output
89	- Frontend bundles — `NEXT_PUBLIC_` / `VITE_` / `REACT_APP_*` env vars are shipped to the browser; grep the bundled JS
90	- Crash reports — Sentry / Datadog / Bugsnag capturing `process.env` snapshots
91	- Logs — application logs shipped to a SIEM that has weaker access controls than the app
92	- Backups — `pg_dump` of a table that includes user-stored API keys
93	- Public S3 / blob storage — `.env` accidentally uploaded
94	- Documentation — README.md examples with real keys instead of placeholders
95	- Slack / Notion / Linear — pasted in a DM "to test," never rotated
96	- Browser localStorage / cookies — captured in shared screenshots or session replays
97
98	### Triaging a found secret
99
100	When you find a leaked secret:
101
102	1. Verify it's live — use the provi

briiirussellPublisher · 30 listings

Preview

briiirussell/cybersecurity-skills

# Secrets Audit — Credential Exposure and Secrets-Management Review

Two halves: (1) find secrets that have already leaked into source, history, or artifacts, and (2) audit the secrets-management posture that determines whether f

Most secret leaks aren't "we forgot to redact" — they're "we never had a system, so every developer made up their own approach." This skill covers both the clea

Cross-references: `dependency-audit` (CI-related secrets risk in build-time exposure), `iam-audit` (workload identity federation as the alternative to long-live

Repobriiirussell/cybersecurity-skills

LicenseMIT

TypeSkills

CategorySecurity

UpdatedMay 2026

Repo stars320

First seenJul 22, 2026

People who liked this also viewed

6 picks

Type