Secrets Scanner

Detects hardcoded secrets and sensitive data in the codebase.

When to Use

• "Scan for secrets"
• "Check for API keys"
• "Audit for credentials"
• "Find hardcoded passwords"
• "PII scan"

What to Detect

High Priority (Block Merge)

Medium Priority (Review)

PII Patterns

Allowed Exceptions

These files are expected to have secret-like patterns:

• .env.example - Template placeholders only
• *.test.ts - Test fixtures
• Documentation files - Examples only

Procedure

Step 1: Scan for API Keys

Grep: (OPENAI_API_KEY|ANTHROPIC_API_KEY|sk-[a-zA-Z0-9]{32,})
Exclude: .env.example, *.md, node_modules

Step 2: Scan for Credentials

Grep: (password|secret|credential|token)\s*[:=]\s*['"][^'"]+['"]
Exclude: .env.example, node_modules

Step 3: Scan for Private Keys

Grep: -----BEGIN.*PRIVATE KEY-----

Step 4: Scan for Database URLs

Grep: (postgres|mysql|mongodb)://[^:]+:[^@]+@
Exclude: .env.example, docker-compose.yml

Step 5: Check .env Files

Glob: **/.env*
Read: Each file (except .env.example)

Ensure .env is in .gitignore.

Step 6: Generate Report

## Secrets Scan Report

### 🔴 Critical Findings

{List of actual secrets found with file:line}

### 🟡 Suspicious Patterns

{Patterns that look like secrets but may be false positives}

### ✅ Verified Safe

- .env.example contains only placeholders
- Test files use mock values
- .gitignore excludes .env files

### Recommendations

{Actions to take}

False Positive Handling

Common false positives:

• Example values in docs: sk-example-key-123
• Test fixtures: test-token-abc
• Environment variable names: OPENAIAPIKEY=
• Base64 encoded data (non-secret)

Verify by checking:

1. Is it in a test/example file?
2. Does it match real credential format?
3. Is it actually used in production code?

Guardrails

• DO NOT expose found secrets in output (truncate)
• DO NOT assume patterns are secrets without verification
• ALWAYS check .gitignore for .env exclusion
• Report findings privately (not in PR comments)
• Recommend credential rotation if secrets found in history