Secrets Management Audit (FIND/FIX — credentials & keys)

Overview

Leaked secrets are among the fastest paths to compromise — one committed key can hand over a whole cloud account. This skill finds exposed secrets everywhere they hide and audits whether the app manages them properly (vaulted, rotated, scoped).

Core principle: A secret in source/history/logs/binary is already public — assume compromised and rotate. Detection without rotation is theater.

Applies when / Skip when

• Applies when: essentially always — every app has secrets/keys/config somewhere (source, git history, logs, env, build artifacts, CI).
• Skip when: effectively never. Even a static site has API keys, deploy creds, or CI tokens.
• If genuinely nothing to scan: say so explicitly — but verify first; "no secrets" is almost always "didn't look hard enough."