secret-detectionlisted

<!-- Native skill bundle for agent-skills (cross-tool convention). Generated by `secure-vibe dev regenerate`. --> <!-- Do not edit by hand; the source of truth is skills/secret-detection/SKILL.md. --> # Secret Detection Detect and prevent hardcoded secrets, API keys, tokens, and credentials in code ## ALWAYS - Check all string literals longer than 20 characters near keywords: `api_key`, `secret`, `token`, `password`, `credential`, `auth`, `bearer`, `private_key`, `access_key`, `client_secret`, `refresh_token`. - Flag any string matching known secret patterns. The bundled pattern set covers AWS (`AKIA...`), GitHub classic (`ghp_`, `gho_`) **and fine-grained** (`github_pat_`) PATs, OpenAI (`sk-`), **Anthropic (`sk-ant-api03-`)**, Slack (`xox[baprs]-`), Stripe (`sk_live_`), Google (`AIza...`), **Azure AD client secrets**, **Databricks (`dapi`)**, **Datadog 32-hex with hotword**, **Twilio (`SK`)**, **SendGrid (`SG.`)**, **npm (`npm_`)**, **PyPI upload (`pypi-AgEI`)**, **Heroku UUID with hotword**, **DigitalOcean (`dop_v1_`)**, **HashiCorp Vault (`hvs.`)**, **Supabase (`sbp_`)**, **Linear (`lin_api_`)**, JWT, and PEM private keys. - Verify `.gitignore` includes: `*.pem`, `*.key`, `.env`, `.env.*`, `*credentials*`, `*secret*`, `id_rsa*`, `*.ppk`. - Prefer environment variable usage (`os.environ`, `process.env`, `os.Getenv`) over hardcoded values for any credential, connection string, or API endpoint that has an attached secret. - Suggest a secret manager (1Password, AWS Secrets