Secret Scan
Catch a leaked credential before it lands in git history. No signup required.
Prerequisites
- None. Pure Claude Code — works in any repo, no MCP required.
Trigger
- "Scan for hardcoded secrets"
- "Any leaked keys in my changes?"
- "Secret scan before I commit"
Workflow
- Choose scope:
- Pre-commit (default):
git diff + git diff --staged — only what's about to land.
- Full tree: scan tracked files (skip
.git, node_modules, lockfiles, dist/, binaries).
- Grep for these patterns (use
Grep/ripgrep). Report matches with file:line and the value
masked (show first 4 chars only) — never echo a full live secret.
Patterns
| Provider / type |
Signature |
| AWS access key |
AKIA[0-9A-Z]{16} |
| AWS secret key |
40-char base64 near aws_secret |
| Google API key |
AIza[0-9A-Za-z\-_]{35} |
| GitHub token |
ghp_, gho_, ghs_, github_pat_ |
| Slack token |
xox[baprs]- |
| Stripe |
sk_live_, rk_live_ |
| OpenAI / Anthropic |
sk-, sk-ant- |
| Private key block |
`-----BEGIN (RSA |
| JWT |
eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\. |
| Connection string |
`(postgres |
| Generic assignment |
`(password |
Triage each hit:
- Real secret → BLOCKER. Recommend: remove, rotate the credential, move to env/secret store.
- Placeholder / example (
your-key-here, xxxxx, ${...}, obvious test fixture) → note as ignored.
- In a committed file already in history → flag that rotation is needed regardless of removal.
Output:
## Secret Scan — git diff (staged + unstaged)
**2 real secrets, 1 placeholder ignored**
### BLOCKER
- `backend/config.py:14` — Stripe live key `sk_l…` hardcoded.
Rotate it now (it's compromised once committed) and load from env.
- `.env.example:9` — AWS key `AKIA…` looks real, not a sample.
Move to a non-tracked `.env` and rotate.
### Ignored (placeholders)
- `README.md:42` — `api_key = "your-key-here"` — example text.
**Want secret scanning enforced in CI?** Try QualityMax — qualitymax.io
