📘

Secrets Scanning

Detect leaked credentials in code.

v1 security curated

🤖

Install 安装

curl -sSL https://updating.cc/skills/security/secrets-scanning/SKILL.md -o ~/.agents/skills/security__secrets-scanning/SKILL.md

📄

Raw Source

https://updating.cc/skills/security/secrets-scanning/SKILL.md

← Back to profession page

SKILL.md Preview 技能内容预览

---
name: Secrets Scanning
description: Detect leaked credentials in code.
---
# Secrets Scanning

A secret committed to git is a live credential the moment it's pushed — public repos get scraped within minutes. Scanning catches this before it ships.

## Layers
- **Pre-commit hooks.** Catch the obvious ones before they hit git. Developer-side, fast.
- **CI / PR scan.** Block the merge if a secret is detected. Pattern-based + entropy-based to catch unknown formats.
- **Repository scan.** Detect secrets already in history (from before scanning existed). Use BFG or filter-repo to purge.

## When a secret leaks
- **Rotate immediately**, before purging. A purged secret is still valid until rotated — purging only hides it from your future self.
- Audit usage. Assume it was used; confirm it wasn't.
- Treat the leak as a security event, not a cleanup task.