c3f43d8b61
- Add 60 new agents across all 10 categories (75 -> 135) - Add 95 new plugins with command files (25 -> 120) - Update all agents to use model: opus - Update README with complete plugin/agent tables - Update marketplace.json with all 120 plugins
50 lines
1.8 KiB
Markdown
50 lines
1.8 KiB
Markdown
Scan the codebase for leaked secrets, API keys, tokens, and credentials.
|
|
|
|
## Steps
|
|
|
|
1. Define patterns to search for:
|
|
- AWS keys: `AKIA[0-9A-Z]{16}`, `aws_secret_access_key`.
|
|
- API keys: `sk-[a-zA-Z0-9]{32,}`, `api[_-]?key\s*[:=]`.
|
|
- Tokens: `ghp_`, `gho_`, `github_pat_`, `xoxb-`, `xoxp-`.
|
|
- Private keys: `-----BEGIN (RSA|EC|OPENSSH) PRIVATE KEY-----`.
|
|
- Database URLs: `(postgres|mysql|mongodb)://[^:]+:[^@]+@`.
|
|
- Generic secrets: `password\s*[:=]\s*["'][^"']+["']`, `secret\s*[:=]`.
|
|
2. Scan all tracked files: `git ls-files` (skip binary files).
|
|
3. Also scan `.env` files that may not be tracked.
|
|
4. Exclude known false positives (test fixtures, documentation examples, `.env.example`).
|
|
5. For each finding, determine severity:
|
|
- **CRITICAL**: Real credentials with high entropy that appear functional.
|
|
- **WARNING**: Patterns that look like secrets but may be placeholders.
|
|
- **INFO**: References to secret names without values.
|
|
6. Check if `.gitignore` properly excludes sensitive files (`.env`, `*.pem`, `*.key`).
|
|
7. Suggest remediation for each finding.
|
|
|
|
## Format
|
|
|
|
```
|
|
Secrets Scan Results
|
|
====================
|
|
|
|
CRITICAL (immediate action required):
|
|
- <file>:<line> - <type>: <masked-value>
|
|
|
|
WARNING (review needed):
|
|
- <file>:<line> - <type>: <description>
|
|
|
|
.gitignore check:
|
|
- [ ] .env files excluded
|
|
- [ ] Key files excluded
|
|
|
|
Remediation:
|
|
1. Rotate <credential type>
|
|
2. Add <pattern> to .gitignore
|
|
```
|
|
|
|
## Rules
|
|
|
|
- Never print full secret values; mask all but the first 4 characters.
|
|
- Scan both tracked and untracked files.
|
|
- Check git history for secrets in past commits using `git log -p --all -S`.
|
|
- Suggest `.gitignore` additions for any unprotected secret file patterns.
|
|
- Recommend using environment variables or secret managers for all findings.
|