/secrets-scan

Scan the codebase for leaked secrets, API keys, tokens, and credentials.

Steps

1. Define patterns to search for:

• AWS keys: `AKIA[0-9A-Z]{16}`, `aws_secret_access_key`.
• API keys: `sk-[a-zA-Z0-9]{32,}`, `api[_-]?key\s*[:=]`.
• Tokens: `ghp_`, `gho_`, `github_pat_`, `xoxb-`, `xoxp-`.
• Private keys: `-----BEGIN (RSA|EC|OPENSSH) PRIVATE KEY-----`.
• Database URLs: `(postgres|mysql|mongodb)://[^:]+:[^@]+@`.
• Generic secrets: `password\s*[:=]\s*["'][^"']+["']`, `secret\s*[:=]`.

2. Scan all tracked files: `git ls-files` (skip binary files). 3. Also scan `.env` files that may not be tracked. 4. Exclude known false positives (test fixtures, documentation examples, `.env.example`). 5. For each finding, determine severity:

• **CRITICAL**: Real credentials with high entropy that appear functional.
• **WARNING**: Patterns that look like secrets but may be placeholders.
• **INFO**: References to secret names without values.

6. Check if `.gitignore` properly excludes sensitive files (`.env`, `*.pem`, `*.key`). 7. Suggest remediation for each finding.

Format

Secrets Scan Results
====================

CRITICAL (immediate action required):
  - <file>:<line> - <type>: <masked-value>

WARNING (review needed):
  - <file>:<line> - <type>: <description>

.gitignore check:
  - [ ] .env files excluded
  - [ ] Key files excluded

Remediation:
  1. Rotate <credential type>
  2. Add <pattern> to .gitignore

Rules

• Never print full secret values; mask all but the first 4 characters.
• Scan both tracked and untracked files.
• Check git history for secrets in past commits using `git log -p --all -S`.
• Suggest `.gitignore` additions for any unprotected secret file patterns.
• Recommend using environment variables or secret managers for all findings.