secret-scanlisted

**Version**: 1.0 **Created**: 2026-03-21 **Last Updated**: 2026-03-21 **Authors:** ��mer Ufuk --- # /secret-scan — Detect Leaked Secrets ## When to Use Invoke `/secret-scan` when: - Before any PR that adds configuration, environment handling, or credential logic - After onboarding a new dependency that requires API keys - As a routine check before releases - When `.env` files, config templates, or CI/CD workflows are modified - After resolving a secret leak incident to verify full remediation --- ## Prerequisites Install `gitleaks` (required): ```bash # macOS brew install gitleaks # Linux go install github.com/gitleaks/gitleaks/v8@latest # Verify installation gitleaks version ``` --- ## Invocation ```bash /secret-scan ``` --- ## Behavior ### Step 1: Scan Working Directory Scan the current codebase for secrets in tracked files: ```bash gitleaks detect --source . --verbose ``` Review every finding. False positives should be suppressed via a `.gitleaks.toml` allowlist, not by ignoring them. ### Step 2: Scan Git History Scan the full git history for secrets that were committed and later removed: ```bash gitleaks detect --source . --log-opts="--all" --verbose ``` Secrets removed from the working tree may still exist in git history. These are exploitable if the repository is cloned. ### Step 3: Platform-Specific Pattern Search Supplement gitleaks with targeted grep patterns for known high-value secrets: ```bash # Stripe keys grep -rn 'sk_live_\|sk_test_\|