evandrodevbr
c17192c9fe
Copia local (nao fork, nao submodule) de safedeps, sca-audit, secrets-scan, code-review-security, api-security-review, web-security-review, cve-triage, patch-prioritization, dependency-scanning e hermaguard -- commit exato de origem e licenca de cada uma em skills/NOTICE.md. Elimina o passo de clone externo pro pilar de seguranca do wf-security-review: git clone deste repo ja traz tudo funcional. Corrige tambem o comando de instalacao pro Claude Code nos dois READMEs e no docs/SKILLS.md: Claude Code exige um diretorio por skill (skills/<nome>/SKILL.md), nao aceita os .md soltos que o comando antigo copiava -- confirmado testando a instalacao real.
2.1 KiB
name, description, license
| name | description | license |
|---|---|---|
| secrets-scan | Detect hardcoded credentials, API keys, tokens, and secrets in source code and configuration files. Use when reviewing code for leaked secrets before commit/merge, auditing a repository for credential exposure, or setting up secret detection. | CC-BY-4.0 |
Secrets Scan
Detect hardcoded secrets by following the full procedure in plays/secrets-scan.md.
Steps
-
Run Automated Scanner — Use available tools in preference order:
trufflehog filesystem --directory=<path> --json(recommended)trufflehog git file://<repo> --json(includes git history)gitleaks detect --source=<path> --report-format=jsondetect-secrets scan <path> --all-files- If no scanner available, proceed with manual pattern analysis.
-
Manual Pattern Analysis — Search for high-confidence patterns:
- AWS keys (
AKIA...), OpenAI (sk-...), Anthropic (sk-ant-...), GitHub (ghp_...), Slack (xoxb-...), Stripe (sk_live_...), SendGrid (SG.) - Connection strings with embedded passwords (
://user:pass@host) - Private keys (PEM headers), JWT secrets, database credentials
- High-risk files:
.env,docker-compose*.yml,*.tfvars,terraform.tfstate,kubeconfig,.npmrc,.pypirc
- AWS keys (
-
Contextual Analysis — For each detection: Is it real (not a placeholder/test fixture)? Is it active? What's the blast radius (service, permissions, prod vs dev, exposure duration)?
-
Check Preventive Controls — Verify:
.gitignorecovers sensitive files, pre-commit hooks for secret scanning, CI pipeline scanning, secrets management documentation.
Important: Never include actual secret values in findings. Show redacted versions only (e.g., AKIA****EXAMPLE). Active production secrets require immediate rotation.
Output
Scan summary, findings using templates/finding.md, preventive controls checklist, and immediate rotation actions if needed.
OWASP References
- A07:2021: Identification and Authentication Failures
- CWE-798: Use of Hard-coded Credentials
- CWE-312: Cleartext Storage of Sensitive Information