secrets-sweeper-litelisted

# Secrets Sweeper Lite Scan anything you are about to publish, open-source, or hand to a contractor for the ten credential types that hurt the most — and get masked terminal findings before it leaves your machine. ## When to use / when not to use Use this skill when: - You are about to publish or open-source a directory and want a fast check that it contains no hardcoded keys or tokens. - You suspect a key was hardcoded somewhere in a project and want it located. - You want a lightweight CI gate that fails a build when a credential appears (exit code 1 on any finding). Do NOT use this skill for: - Rotating, revoking, or validating credentials — the findings tell you where to rotate; the action is yours. - Scanning git history — this scans the working tree only. - PII coverage (emails, phone numbers, IPs, personal paths) or custom denylist terms (person names, internal codenames) — full version territory. - Runtime secret management — this is not a vault or a .env loader. - Judging whether a package is malicious or manipulative — out of scope by design. ## Quick start ``` python scripts/sweeper_lite.py <target-dir> ``` That one line scans `<target-dir>` recursively, prints masked findings to the terminal, and exits `1` if anything was found (`0` clean, `2` error). ``` python scripts/sweeper_lite.py --list-rules # print the 10-rule table python scripts/sweeper_lite.py <dir> --quiet # findings + summary only ``` #