GitHub secret scanning configuration, push protection, custom pattern definitions, and response playbook for detected credentials in GitHub Actions workflows.
Scans GitHub Actions workflows, commits, and logs for exposed credentials using push protection and custom patterns. Triggers when reviewing pull requests or analyzing workflow files to detect and remediate leaked secrets before they're exploited.
/plugin marketplace add adaptive-enforcement-lab/claude-skills/plugin install secure@ael-skillsThis skill inherits all available tools. When active, it can use any tool Claude has access to.
examples.mdreference.mdscripts/example-1.yamlscripts/example-2.shscripts/example-3.mermaidscripts/example-4.shscripts/example-5.yamlscripts/example-6.regexscripts/example-7.shscripts/example-8.mermaidPrevention is good. Detection is essential. Assume secrets will leak. Build systems to catch them before damage spreads.
The Risk
Secrets leak through commits, workflow logs, artifacts, pull requests, and third-party integrations. Without automated scanning, credentials remain exposed for days or months before detection. By then, your infrastructure is already compromised.
See the full implementation guide in the source documentation.
See examples.md for code examples.
See reference.md for complete documentation.