secret-scanner

# Secret Scanner — leaked credential detection Load this skill when you need to **scan a codebase, directory, or git repo for leaked secrets/tokens/keys** (before publishing a repo, before a release, or during security review). The scanner is **static and offline by design**: patterns come from the [gitleaks v8.30.3 default config](https://github.com/gitleaks/gitleaks), the canonical open-source secret-detection rule set, and detection uses the same Shannon-entropy gating semantics as gitleaks. No network calls are made — a format match is reported as **potential**, not verified. --- ## The scanner script `scripts/secret_scanner.py` — pure Python 3 stdlib (no dependencies). | Source | Command | |---|---| | File | `python3 secret_scanner.py --path path/to/file` | | Directory (recursive) | `python3 secret_scanner.py --path path/to/dir` | | Git repo (tracked files) | `secret_scanner.py --git /path/to/repo` | | stdin (blob) | `cat file | secret_scanner.py` | ### Detected pattern families (19 rules) Critical: AWS Access Key ID (`AKIA`/`ASIA`/`ABIA`/`A3T…`) & secret key, GitHub PAT classic/fine-grained/refresh tokens, OpenAI (`sk-*T3BlbkFJ*`), Anthropic (`sk-ant-api03-…AA`), Stripe (`sk_live_`/`rk_live_`), Google API key (`AIza…`), private keys (PEM/OpenSSH/PGP blocks). High: Slack app/bot/user tokens and webhooks, Perplexity (`pplx-…`). Medium: JWT, generic keyword-anchored API keys. ### False-positive suppression (allowlists) - **Placeholders**: `$VAR`, `${VAR}`, `{{ }}...