Secrets Detection Patterns

Overview

Pattern-based secrets detection for source code. This skill provides regex patterns, false positive filtering criteria, and remediation guidance for detecting hardcoded secrets. It is self-contained — no external tools (trufflehog, gitleaks) are required, though they are recommended as complementary tooling.

Zero Tolerance Policy

Any confirmed secret in code results in a BLOCKED verdict. There is no passing threshold — secrets in code are a critical finding. A secret is either present or it is not.

Redaction Rule

Reports must NEVER include actual secret values. Report secret type, file path, and line number only. Pattern matches are redacted to show type and location: e.g., "AWS Access Key at src/config.js:42".

Scan Scope Options

• Staged — scan git staged files only (pre-commit gate)
• All — scan entire working directory
• History — scan git commit history (post-incident review)