no-exposed-secretslisted

# No-Exposed-Secrets A pre-commit / pre-publish safety gate. Its one job: **make sure no secret ever lands in the repo.** ## When to use - Before any commit or push (act as the gate). - When the user pastes or writes code that touches API keys, tokens, DB URLs, or `.env`. - When asked to "review this for secrets", "is this safe to commit", or similar. - As a CI check. ## How to run it 1. Run the bundled scanner over the target (a path, or staged git changes): ```bash python scan_secrets.py <path> # scan a file or directory python scan_secrets.py --staged # scan only git-staged changes ``` 2. Exit code `0` = clean. Exit code `1` = secrets found (block the action). 3. The scanner prints each finding as `severity | file:line | type | redacted snippet`. ## How to respond to findings For each finding: - **Confirm it's a real secret** (not a placeholder like `YOUR_API_KEY` or a test fixture). - **Do NOT print the secret value back** — reference it by file:line and type only. - **Remediate**, in this order: 1. Move the value to an environment variable or a secrets manager (AWS Secrets Manager, SSM, Vault, 1Password, etc.). 2. Replace the hardcoded value in code with a reference (`os.environ[...]`, config lookup). 3. Add the offending file to `.gitignore` if it's a local config (`.env`, `*.pem`). 4. **Rotate** any secret that was already committed — assume it's compromised. - Re-run the scanner to confirm the gate passes. ## Suppressing false posi