Secrets Scan

Detect hardcoded secrets by following the full procedure in plays/secrets-scan.md.

Steps

1. Run Automated Scanner — Use available tools in preference order:

   • trufflehog filesystem --directory=<path> --json (recommended)
   • trufflehog git file://<repo> --json (includes git history)
   • gitleaks detect --source=<path> --report-format=json
   • detect-secrets scan <path> --all-files
   • If no scanner available, proceed with manual pattern analysis.

2. Manual Pattern Analysis — Search for high-confidence patterns:

   • AWS keys (AKIA...), OpenAI (sk-...), Anthropic (sk-ant-...), GitHub (ghp_...), Slack (xoxb-...), Stripe (sk_live_...), SendGrid (SG.)
   • Connection strings with embedded passwords (://user:pass@host)
   • Private keys (PEM headers), JWT secrets, database credentials
   • High-risk files: .env, docker-compose*.yml, *.tfvars, terraform.tfstate, kubeconfig, .npmrc, .pypirc