secret-detection

• SKILL.mdcore · 5,760 bytes
• SKILL.mdcore · 5,760 bytes
• metadata.jsonasset · 1,367 bytes
• references/verifying-findings.mddoc · 2,512 bytes

<!-- Native skill bundle for Claude Code. Generated by `secure-vibe dev regenerate`. -->
<!-- Do not edit by hand; the source of truth is skills/secret-detection/SKILL.md. -->

# Secret Detection

Keeping credentials out of source, and what to do once one is in: rotate before removing, because deleting the line does not un-leak it. Covers where a secret may live, safe .env templates, why a client-reachable config value is public, and running a scanner rather than eyeballing for patterns. Use when writing code that reads a credential, creating config or .env templates, before committing, or after discovering a secret in a repository.

## ALWAYS

- On finding a committed credential, **rotate or revoke it at the provider first**. Deleting the line does not remediate it, and neither does `git rm`, an amended commit, or a history rewrite: the value reached a remote, a clone, a fork, a CI log and a backup, and it is compromised from the moment it was pushed. Rotate, then clean the history, then add the guard that stops it recurring — in that order, because only the first one is time-critical.
- **Run a scanner**; do not scan by eye. `scan_secrets` and `check_secret_pattern` carry the full pattern set with per-pattern entropy floors and hotword proximity, and a person reading a diff matches none of that reliably. A working-tree scan and a history scan answer different questions — the first says what you are about to commit, the second says what is already public.
- Read the credential from the environment or a secret manager at the point of use — `os.environ`, `process.env`, `os.Getenv`, a Vault / AWS Secrets Manager / GCP Secret Manager / 1Password client. Nothing about the value should be reconstructible from the repository.
- Ship a **`.env.example`** that is committed and contains every key with an empty or obviously-fake value, alongside a `.env` that is ignored and never committed. The example file is documentation, so it must never be produced by copying a working `.env` and editing it — that is how a real value survives into the template.
- Ignore the file classes that carry key material, in one list: `.env`, `.env.*` (but not `.env.example`), `*.pem`, `*.key`, `*.p12`, `*.pfx`, `*.ppk`, `id_rsa*`, `id_dsa*`, `id_ecdsa*`, `id_ed25519*`, `*credentials*`, `*secret*`. A `.gitignore` entry is a guard against habit, not a control — it does nothing for a file already tracked, and `git add -f` overrides it.