Loading...
Loading...
Detects hardcoded secrets, API keys, passwords, and credentials in source code. Use when checking for leaked secrets, credential exposure, or before committing code.
npx skill4agent add armanzeroeight/fastagent-plugins secrets-detector# Install
brew install gitleaks # macOS
# or
pip install detect-secrets
# Scan current directory
gitleaks detect --source .gitleaks detect --source . --verbosedetect-secrets scan . --all-filesgrep -rn "AKIA[0-9A-Z]{16}" . # AWS Access Key
grep -rn "ghp_[a-zA-Z0-9]{36}" . # GitHub Token| Secret Type | Pattern | Example |
|---|---|---|
| AWS Access Key | | AKIAIOSFODNN7EXAMPLE |
| AWS Secret Key | | wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY |
| GitHub Token | | ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx |
| GitHub OAuth | | gho_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx |
| Slack Token | | xoxb-123456789-abcdefghij |
| Private Key | | RSA/EC private keys |
| Generic API Key | | api_key = "abc123..." |
| Generic Password | | password = "secret123" |
# Scan entire git history
gitleaks detect --source . --log-opts="--all"
# Check specific commits
git log -p --all -S 'password' --source## Secrets Detection Report
### Critical (1)
1. **AWS Secret Key** - config/aws.js:12
- Type: AWS credentials
- Action: Rotate immediately in AWS console
### High (2)
1. **GitHub Token** - scripts/deploy.sh:45
- Type: Personal access token
- Action: Revoke and regenerate
2. **Slack Webhook** - src/notifications.js:23
- Type: Incoming webhook URL
- Action: Regenerate webhook# .pre-commit-config.yaml
repos:
- repo: https://github.com/gitleaks/gitleaks
rev: v8.18.0
hooks:
- id: gitleaks# Environment files
.env
.env.local
.env.*.local
# Key files
*.pem
*.key
*_rsa
*_ecdsa
*_ed25519
# Config with secrets
config/secrets.yml
credentials.json// BAD
const apiKey = "sk-abc123...";
// GOOD
const apiKey = process.env.API_KEY;