code-review-secrets-detection
Find leaked secrets in code, git history, and CI. Load on "secrets", "leaked key", a repo/ git history in scope, exposed .git, CI config review, or public-repo OSINT. Signals: API keys, tokens, .env f
SKILL.mdskills/code-review/code-review-secrets-detection/SKILL.md
GitHubSecrets detection
When it applies
Any source you can read: an in-scope repo, an exposed .git/ on a web server, public GitHub
repos of the org, or CI/CD config. Live secrets are direct, high-impact findings.
Why it works
Secrets get committed and then "removed" — but git keeps history, so they persist in old commits, branches, and stashes. Config/CI files and client bundles also embed keys that ship to users.
Method
- Scan history, not just HEAD:
trufflehog git file://. --only-verifiedorgitleaks detect --source . -v— these walk every commit and (trufflehog) verify keys live. - Exposed .git on a target:
git-dumper http://target/.git/ out/then scan the recovered repo. - Org-wide OSINT: GitHub dorks /
trufflehog github --org=<org>for public leaks (in scope only). - Client-side & config: grep JS bundles, mobile apps,
.env, Dockerfiles, k8s manifests, CI YAML for keys and tokens. - Validate & scope impact: confirm the key works with a read-only call (e.g.
aws sts get-caller-identity) — a live, privileged key is the report; a dead one is informational.
Gotchas
- Report verified/live secrets; example/placeholder keys inflate severity and get closed as N/A.
- Rotate-awareness: note it may be live now; don't exfiltrate data with it — prove access, stop.
- Deleted-from-HEAD ≠ gone — always scan full history.
Verify success
A secret that authenticates successfully (minimal proof), with where it lives (commit/file) — don't paste the secret value into reports, reference its location.
References
trufflehog & gitleaks docs; GitHub secret-scanning; OWASP secrets management.