version: "1.0.0" name: no-exposed-secrets description: > Safety gate that scans code, config, and diffs for exposed secrets — API keys, tokens, passwords, private keys, cloud credentials, and .env leaks — before a commit, pull request, or publish. Use whenever the user is about to commit or push, asks to review or check code for secrets/credentials, is wiring up a new integration or API key, or wants a pre-publish safety check. Deterministic scanner + guided remediation.

No-Exposed-Secrets

A pre-commit / pre-publish safety gate. Its one job: make sure no secret ever lands in the repo.

When to use

• Before any commit or push (act as the gate).
• When the user pastes or writes code that touches API keys, tokens, DB URLs, or .env.
• When asked to "review this for secrets", "is this safe to commit", or similar.
• As a CI check.

How to run it

1. Run the bundled scanner over the target (a path, or staged git changes):

``bash python scan_secrets.py <path> # scan a file or directory python scan_secrets.py --staged # scan only git-staged changes ``

1. Exit code 0 = clean. Exit code 1 = secrets found (block the action).
2. The scanner prints each finding as severity | file:line | type | redacted snippet.

How to respond to findings

For each finding:

• Confirm it's a real secret (not a placeholder like YOUR_API_KEY or a test fixture).
• Do NOT print the secret value back — reference it by file:line and type only.
• Remediate, in this order:

1. Move the value to an environment variable or a secrets manager (AWS Secrets Manager, SSM, Vault, 1Password, etc.).
2. Replace the hardcoded value in code with a reference (os.environ[...], config lookup).
3. Add the offending file to .gitignore if it's a local config (.env, *.pem).
4. Rotate any secret that was already committed — assume it's compromised.

• Re-run the scanner to confirm the gate passes.

Suppressing false positives

Append # pragma: allowlist secret to a line to intentionally ignore it (use sparingly, e.g. documented test fixtures). The scanner honors this marker.

What it detects

AWS access/secret keys, GCP/Google API keys, GitHub/GitLab/Slack/Stripe tokens, JWTs, private keys (RSA/EC/OpenSSH/PGP), generic KEY=secret assignments, connection strings with inline credentials, and high-entropy strings. See scan_secrets.py for the full pattern set.

Install

Drop this folder into your Claude skills directory (e.g. ~/.claude/skills/no-exposed-secrets/) or a Claude Code plugin's skills/. Claude loads it automatically when the description matches.