secrets-hygienelisted

# secrets-hygiene Credentials that reach git are compromised. Deletion and force-push clean history; only rotation kills the credential. This skill covers detection, response order, and the steady-state setup that keeps new leaks from shipping. ## Detection gates | Gate | Where | Tool shape | Limits | |---|---|---|---| | Pre-commit | Developer machine | gitleaks / git-secrets hook on the diff | `--no-verify` bypass; hook must be installed | | CI | PR and default branch | gitleaks detect, TruffleHog, platform secret scanning | Misses secrets only in old history | | History | Full repo, periodic | `gitleaks git`, TruffleHog history mode | Slow on large repos; needs triage | Enable all three. Tune false positives weekly until the team stops disabling hooks; a noisy scanner gets switched off. ## When a secret lands in git Order is fixed. Do not start with history surgery. 1. **Identify** the credential type, scope, and where it is used. 2. **Rotate or revoke** at the provider. The old value must stop working before anything else. 3. **Update** every consumer (deploy env, secret store, local `.env` that is not committed). 4. **Purge history** with `git filter-repo` (or BFG), force-push, coordinate re-clones and fork deletion. 5. **Verify**: full-history scan clean; only the new credential authenticates; provider audit log reviewed for use of the old key. Public remote or CI logs: assume the scrapers already have it. Rotate first, always. ## Steady state - Never commit `.