mcpField
S
secrets-scan

secrets-scan

github.com/owaspSecurity208357 installsUpdated 2w ago
Repository

About secrets-scan

A secrets-scanning skill for developers maintaining codebases and repositories. It combines available automated scanners with manual pattern and context checks, and specifies redaction and response steps for detected credentials.

Key features

  1. 01Automated scanner selection
  2. 02Manual secret-pattern checks
  3. 03Detection context assessment
  4. 04Preventive-control checklist
  5. 05Redaction and rotation guidance

Use cases

  1. 01Scanning a codebase for hardcoded credentials
  2. 02Checking repository history for exposed secrets
  3. 03Assessing and responding to detected credentials

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/owasp/secure-agent-playbook --skill secrets-scan

After installing, type/secrets-scanin Claude Code to confirm it loaded.

Details

From the project README

Secrets Scan

Detect hardcoded secrets by following the full procedure in plays/secrets-scan.md.

Steps

  1. Run Automated Scanner — Use available tools in preference order:

    • trufflehog filesystem --directory=<path> --json (recommended)
    • trufflehog git file://<repo> --json (includes git history)
    • gitleaks detect --source=<path> --report-format=json
    • detect-secrets scan <path> --all-files
    • If no scanner available, proceed with manual pattern analysis.

  2. Manual Pattern Analysis — Search for high-confidence patterns:

    • AWS keys (AKIA...), OpenAI (sk-...), Anthropic (sk-ant-...), GitHub (ghp_...), Slack (xoxb-...), Stripe (sk_live_...), SendGrid (SG.)
    • Connection strings with embedded passwords (://user:pass@host)
    • Private keys (PEM headers), JWT secrets, database credentials
    • High-risk files: .env, docker-compose*.yml, *.tfvars, terraform.tfstate, kubeconfig, .npmrc, .pypirc

  3. Contextual Analysis — For each detection: Is it real (not a placeholder/test fixture)? Is it active? What's the blast radius (service, permissions, prod vs dev, exposure duration)?

  4. Check Preventive Controls — Verify: .gitignore covers sensitive files, pre-commit hooks for secret scanning, CI pipeline scanning, secrets management documentation.

Important: Never include actual secret values in findings. Show redacted versions only (e.g., AKIA****EXAMPLE). Active production secrets require immediate rotation.

Output

Scan summary, findings using templates/finding.md, preventive controls checklist, and immediate rotation actions if needed.

OWASP References

  • A07:2021: Identification and Authentication Failures
  • CWE-798: Use of Hard-coded Credentials
  • CWE-312: Cleartext Storage of Sensitive Information

Comments

Markdown supported