Secret Detection

Secret Detection

Detect and prevent hardcoded secrets, API keys, tokens, and credentials in code

ALWAYS

• Check all string literals longer than 20 characters near keywords: api_key, secret, token, password, credential, auth, bearer, private_key, access_key, client_secret, refresh_token.
• Flag any string matching known secret patterns. The bundled pattern set covers AWS (AKIA...), GitHub classic (ghp_, gho_) and fine-grained (github_pat_) PATs, OpenAI (sk-), Anthropic (sk-ant-api03-), Slack (xox[baprs]-), Stripe (sk_live_), Google (AIza...), Azure AD client secrets, Databricks (dapi), Datadog 32-hex with hotword, Twilio (SK), SendGrid (SG.), npm (npm_), PyPI upload (pypi-AgEI), Heroku UUID with hotword, DigitalOcean (dop_v1_), HashiCorp Vault (hvs.), Supabase (sbp_), Linear (lin_api_), JWT, and PEM private keys.
• Verify .gitignore includes: *.pem, *.key, .env, .env.*, *credentials*, *secret*, id_rsa*, *.ppk.
• Prefer environment variable usage (os.environ, process.env, os.Getenv) over hardcoded values for any credential, connection string, or API endpoint that has an attached secret.
• Suggest a secret manager (1Password, AWS Secrets Manager, HashiCorp Vault, Doppler) when credentials must be shared across machines or services.
• Treat every client-reachable config value as public — Firebase Remote Config, LaunchDarkly / feature flags, a /config endpoint, and any build-time env baked into a shipped bundle. Put no secret there; a client may only ever hold public identifiers.

NEVER

• Commit files matching: *.pem, *.key, *.p12, *.pfx, .env, .env.local, *credentials*, id_rsa, id_dsa, id_ecdsa, id_ed25519.
• Hardcode API keys, tokens, passwords, or connection strings in source code.
• Include real secrets in test fixtures — use documented placeholders such as AKIAIOSFODNN7EXAMPLE, wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY, or xoxb-EXAMPLE-EXAMPLE.
• Log or print secret values, even in debug mode.
• Echo secrets to terminals in CI logs (mask via ::add-mask:: in GitHub Actions).
• Embed signing keys in container images, even base images.
• Distribute a bearer secret (webhook URL, API key, signing key) to clients at runtime via a config / feature-flag service (Remote Config, LaunchDarkly, a /config response). Anyone holding the app's public config can fetch it — it is as exposed as a hardcoded secret. Keep it server-side and proxy the privileged call through an authenticated backend that validates and rate-limits the request.

KNOWN FALSE POSITIVES

• AWS documentation example: AKIAIOSFODNN7EXAMPLE and the matching secret access key wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY.
• Strings containing: "example", "test", "placeholder", "dummy", "sample", "changeme", "your-key-here", "REPLACE_ME", "TODO", "FIXME", "XXX".
• Hash literals in CSS/SCSS (e.g., #ff0000, #deadbeef).
• Base64-encoded non-secret content in tests (lorem ipsum encoded, image fixtures).
• Git commit SHAs in changelogs and release notes.
• JWT tokens in the OAuth RFC documentation examples (eyJ... strings appearing in comments).

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: ShieldNet-360
• Source: ShieldNet-360/secure-vibe
• License: MIT

Install and usage instructions live in the source repository linked above.