Secret Scanner

Scan codebase for exposed secrets, API keys, passwords, and sensitive credentials with pattern matching and entropy analysis.

Features

• Multi-Platform API Keys - AWS, GCP, Azure, Stripe, GitHub, etc.
• Pattern Matching - Known secret formats
• Entropy Analysis - Detect random strings that may be secrets
• Git History Scanning - Find secrets in commit history
• Comprehensive Reporting - File locations and remediation steps
• Pre-commit Integration - Prevent secret commits

Installation

/plugin install secret-scanner@claude-code-plugins-plus

Usage

# Scan current directory
/scan-secrets

# Or use shortcut
/secrets

What It Detects

API Keys & Tokens

• AWS Access Keys
• Google API Keys
• Azure Storage Keys
• Stripe API Keys
• GitHub Personal Access Tokens
• Slack Tokens
• Twilio API Keys
• SendGrid API Keys
• Mailgun API Keys

Credentials

• Database passwords
• SMTP credentials
• FTP credentials
• SSH private keys
• PGP private keys

Tokens

• OAuth tokens
• JWT tokens
• Session tokens
• Bearer tokens

High-Entropy Strings

• Base64-encoded secrets
• Hexadecimal keys
• Random-looking strings (>4.5 entropy)

Example Report

SECRET SCAN REPORT
==================
Scan Date: 2025-10-11
Secrets Found: 4

CRITICAL SECRETS
----------------

1. AWS Access Key Exposed
   File: src/config/aws.js:12
   Pattern: AKIA[0-9A-Z]{16}
   Value: AKIA****************WXYZ (masked)

   Immediate Actions:
   1. Revoke this key in AWS IAM Console
   2. Generate new access key
   3. Store in environment variable or AWS Secrets Manager
   4. Remove from git history:
…

Remediation Guide

For Exposed API Keys

# 1. Revoke the exposed key immediately
# (Use provider's console/CLI)

# 2. Remove from current files
# Replace with environment variable
export API_KEY="new-key-here"

# 3. Remove from git history
git filter-repo --path config/keys.js --invert-paths

# 4. Add to .gitignore
echo "config/keys.js" >> .gitignore

For Configuration Files

# Create template file
cp .env .env.example
# Remove sensitive values from .env.example

# Add .env to .gitignore
echo ".env" >> .gitignore

# Document required variables
cat > .env.example << EOF
# Required environment variables
API_KEY=your_api_key_here
DATABASE_URL=your_database_url_here
EOF

Best Practices

1. Prevention

• Use environment variables
• Implement pre-commit hooks
• Use secret management tools (Vault, AWS Secrets Manager)
• Review code before committing

1. Detection

• Run scans regularly
• Scan git history periodically
• Monitor CI/CD logs
• Enable secret scanning in GitHub/GitLab

1. Response

• Rotate exposed secrets immediately
• Remove from git history
• Update documentation
• Notify security team

1. Secret Management

• Use HashiCorp Vault
• Use cloud provider secret managers
• Use encrypted configuration
• Implement proper access controls

Pre-commit Hook

Add to .git/hooks/pre-commit:

#!/bin/bash
if /plugin secret-scanner | grep -q "CRITICAL"; then
    echo "ERROR: Secrets detected! Commit blocked."
    exit 1
fi

Requirements

• Read access to codebase
• Read access to git history
• Write access for remediation scripts

License

MIT License - See LICENSE file for details