secrets-guardlisted

# Secrets Guard A leaked secret is one of the fastest paths to a breach — a single committed API key can hand an attacker the whole system. This skill keeps secrets out of the places they leak from, and cleans them up when they've already landed there. The rule underneath everything: **a secret belongs in the runtime environment, never in the source.** If it's in a file that gets committed, shipped to the browser, or printed to a log, treat it as compromised. ## When to reach for this skill Use it whenever code touches credentials: adding an API key, wiring up a database connection, configuring an external service (payment, messaging, storage), setting up `.env` files, or committing configuration. Also whenever the user asks where to store a key or whether something is safe to commit. The presence of a credential is the trigger. ## What to do ### 1. Detect secrets already present Scan for hardcoded credentials in the code and config: high-entropy strings, `apiKey = "..."`, connection strings with embedded passwords, private key blocks, tokens in source. Common shapes: cloud keys, database URLs like `postgres://user:pass@host`, JWT signing secrets, third-party service keys (payment, messaging). Also check what's already committed to git history, not just the working tree — a secret removed from the current code but still in history is still leaked. If a real secret is found in code or history: flag it as **compromised** and requiring rotation, not just removal. Once a