Secrets management. Leak detection, rotation, vault setup, .env management, access auditing.
From godmodenpx claudepluginhub arbazkhan971/godmodeThis skill uses the workspace's default tool permissions.
Designs and optimizes AI agent action spaces, tool definitions, observation formats, error recovery, and context for higher task completion rates.
Enables AI agents to execute x402 payments with per-task budgets, spending controls, and non-custodial wallets via MCP tools. Use when agents pay for APIs, services, or other agents.
Compares coding agents like Claude Code and Aider on custom YAML-defined codebase tasks using git worktrees, measuring pass rate, cost, time, and consistency.
/godmode:secrets, "manage secrets", "rotate credentials"| Secret | Source | Status |
|-----------------------|----------|---------|
| DATABASE_URL | .env | PRESENT |
| JWT_SECRET | .env | PRESENT |
| STRIPE_SECRET_KEY | hardcoded| LEAKED |
# Scan current codebase
gitleaks detect --source . --verbose
# Scan full git history
gitleaks detect --source . --log-opts="--all" --verbose
# Pattern scan for hardcoded secrets
grep -rn 'API_KEY=\|SECRET=\|PASSWORD=\|TOKEN=' \
--include="*.ts" --include="*.py" --include="*.go" \
--include="*.env" src/ 2>/dev/null
IF verified leak found:
1. REVOKE the credential immediately
2. ROTATE — generate new credential
3. REMOVE from code (use env var or vault)
4. SCRUB git history (BFG Repo-Cleaner)
5. VERIFY old credential no longer works
6. AUDIT access logs during exposure window
IF AWS infrastructure: AWS Secrets Manager
(auto-rotation, IAM integration)
IF multi-cloud or on-prem: HashiCorp Vault KV-v2
IF GCP: GCP Secret Manager (auto-replication)
IF Azure: Azure Key Vault
WHEN self-hosted: Vault with AppRole auth
# .env.example — committed (template)
DATABASE_URL=postgres://user:pass@localhost:5432/dev
JWT_SECRET=development-secret-change-in-production
STRIPE_KEY=sk_test_placeholder
# Validate .env against .env.example
diff <(grep -oP '^[A-Z_]+=?' .env.example | sort) \
<(grep -oP '^[A-Z_]+=?' .env | sort)
.ENV SAFETY CHECK:
- [x] .env in .gitignore
- [x] .env.local in .gitignore
- [x] .env.production in .gitignore
- [x] .env.example exists with placeholders
- [ ] .env was never committed to git history
| Secret Type | Rotation | Threshold |
|-------------------|----------|-------------|
| Database passwords| 30 days | OVERDUE >45d|
| API keys | 90 days | OVERDUE >120d|
| JWT signing key | 90 days | OVERDUE >120d|
| TLS certificates | 365 days | OVERDUE >400d|
| OAuth secrets | 180 days | OVERDUE >210d|
ROTATION STEPS:
1. Generate new credential
2. Store in secret manager (new version)
3. Update app (auto if vault, deploy if env)
4. Verify app works with new credential
5. Revoke old (after 24h grace period)
ACCESS CONTROL:
- Each service has own identity (AppRole/IAM)
- Services access only their own secrets
- Human access requires MFA and is logged
- Production secrets never accessed directly
- Access logs retained 90+ days
- Alerts on anomalous access patterns
# Install gitleaks pre-commit hook
cat >> .pre-commit-config.yaml << 'EOF'
repos:
- repo: https://github.com/gitleaks/gitleaks
rev: v8.18.0
hooks:
- id: gitleaks
EOF
pre-commit install
SECRETS AUDIT:
Inventoried: <N>
Managed (vault): <N>
In .env (local): <N>
LEAKED: <N>
Rotation overdue: <N>
Pre-commit hook: ACTIVE | MISSING
Verdict: SECURE | NEEDS ROTATION | LEAKS FOUND
Commit: "secrets: <N> managed, <N> leaks fixed"
ls .env .env.local .env.production 2>/dev/null
grep -q "\.env" .gitignore 2>/dev/null || echo "CRITICAL"
grep -r "vault\|aws-sdk.*secrets\|@google-cloud/secret" \
package.json pyproject.toml 2>/dev/null
Log to .godmode/secrets-audit.tsv:
timestamp\ttotal\tmanaged\tleaked\trotation_overdue\tverdict
KEEP if: verified real credential in production code
DISCARD if: false positive (placeholder, public key)
OR already remediated in previous iteration
STOP when:
- Zero verified leaks in code and git history
- Pre-commit hook installed and active
- All production secrets in vault
- User requests stop