---

name: check-secrets description: Scan the codebase for potential secret leaks including API keys, tokens, passwords, hardcoded project IDs, and sensitive identifiers. Use when the user says "check for secrets", "scan for leaks", "security check", or before committing sensitive changes.

check-secrets

Scan the codebase for potential secret leaks before commits.

Trigger Examples

• "Check for secrets"
• "Scan for leaks"
• "Security check"
• "Are there any hardcoded secrets?"

Execution Flow

1. Define Detection Patterns

High-risk patterns:

• API keys: ['\"]?[A-Z0-9_]{20,}['\"]?
• Bearer tokens: Bearer\s+[A-Za-z0-9\-._~+/]+=*
• Private keys: -----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY-----
• OAuth secrets: client_secret['\"]?\s*[:=]\s*['\"]?[A-Za-z0-9\-_]{20,}
• GCP service account keys: "type":\s*"service_account"
• AWS credentials: AKIA[0-9A-Z]{16}

Project-specific patterns:

• Hardcoded project IDs: koborin-ai (outside of variable assignments or docs)
• Email addresses: @koborin\.ai

Safe patterns (excluded):

• Environment variable references: process.env., $\{, TF_VAR_
• Placeholder values: <PROJECT_ID>, YOUR_API_KEY, dummy, example
• Test fixtures: files under __tests__/, *.test.ts, *.spec.ts

2. Scan the Codebase

Use git ls-files to get tracked files:

git ls-files | grep -v -E '\.(png|jpg|jpeg|gif|svg|woff|woff2|ttf|eot|ico|pdf)$' | \
  grep -v -E '^(node_modules|\.next|dist|build|coverage)/'

3. Filter False Positives

Remove known safe occurrences:

• Lines containing process.env. or TF_VAR_
• Template files (.env.example, .env.template)
• Lines with placeholder patterns (<...>, YOUR_..., REPLACE_ME)

4. Categorize Findings

Critical (immediate action required):

• Private keys, service account JSON
• Hardcoded passwords or tokens
• Real API keys with valid format

Warning (review recommended):

• Suspicious long strings that might be keys
• Hardcoded project IDs outside infrastructure code

Info (low risk):

• Company name in unexpected places
• Domain references in application code

5. Display Results

CRITICAL: Potential private key detected
  File: infra/shared/main.tf
  Line: 42
  Match: -----BEGIN PRIVATE KEY-----

WARNING: Hardcoded project ID
  File: app/src/lib/api-client.ts
  Line: 15
  Match: const PROJECT = "koborin-ai"

Summary:
- Critical: 1 finding(s)
- Warning: 1 finding(s)

Review these findings before committing.

Project-Specific Rules

For koborin-ai:

• Allow koborin-ai in infra/ and README.md
• Flag it in app/src/ unless from environment variable
• Allow email addresses in documentation
• Flag GCP project IDs when hardcoded outside Pulumi config

Notes

• This is static analysis only; cannot detect runtime-loaded secrets
• Always review findings manually
• Run before every commit
• Never commit real secrets even if undetected