Help us improve
Share bugs, ideas, or general feedback.
How this skill is triggered — by the user, by Claude, or both
Slash command
/godmode:secretsThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
- `/godmode:secrets`, "manage secrets", "rotate credentials"
Scans source code, configs, .env files, and git history for hardcoded secrets, API keys, credentials. Audits .gitignore coverage, classifies risks by severity, recommends vault externalization.
Guides secure secrets management using Vault, AWS Secrets Manager, Azure Key Vault, environment variables, rotation, scanning tools, and CI/CD security. For implementing storage, rotation, leak prevention, credentials review.
This skill should be used when the user asks to "find hardcoded secrets", "audit for credential leaks", "check for API keys in code", "review secret scanning alerts", "rotate a leaked secret", or needs to detect hardcoded credentials, review secret handling patterns, or remediate exposed secrets.
Share bugs, ideas, or general feedback.
/godmode:secrets, "manage secrets", "rotate credentials"| Secret | Source | Status |
|-----------------------|----------|---------|
| DATABASE_URL | .env | PRESENT |
| JWT_SECRET | .env | PRESENT |
| STRIPE_SECRET_KEY | hardcoded| LEAKED |
# Scan current codebase
gitleaks detect --source . --verbose
# Scan full git history
gitleaks detect --source . --log-opts="--all" --verbose
# Pattern scan for hardcoded secrets
grep -rn 'API_KEY=\|SECRET=\|PASSWORD=\|TOKEN=' \
--include="*.ts" --include="*.py" --include="*.go" \
--include="*.env" src/ 2>/dev/null
IF verified leak found:
1. REVOKE the credential immediately
2. ROTATE — generate new credential
3. REMOVE from code (use env var or vault)
4. SCRUB git history (BFG Repo-Cleaner)
5. VERIFY old credential no longer works
6. AUDIT access logs during exposure window
IF AWS infrastructure: AWS Secrets Manager
(auto-rotation, IAM integration)
IF multi-cloud or on-prem: HashiCorp Vault KV-v2
IF GCP: GCP Secret Manager (auto-replication)
IF Azure: Azure Key Vault
WHEN self-hosted: Vault with AppRole auth
# .env.example — committed (template)
DATABASE_URL=postgres://user:pass@localhost:5432/dev
JWT_SECRET=development-secret-change-in-production
STRIPE_KEY=sk_test_placeholder
# Validate .env against .env.example
diff <(grep -oP '^[A-Z_]+=?' .env.example | sort) \
<(grep -oP '^[A-Z_]+=?' .env | sort)
.ENV SAFETY CHECK:
- [x] .env in .gitignore
- [x] .env.local in .gitignore
- [x] .env.production in .gitignore
- [x] .env.example exists with placeholders
- [ ] .env was never committed to git history
| Secret Type | Rotation | Threshold |
|-------------------|----------|-------------|
| Database passwords| 30 days | OVERDUE >45d|
| API keys | 90 days | OVERDUE >120d|
| JWT signing key | 90 days | OVERDUE >120d|
| TLS certificates | 365 days | OVERDUE >400d|
| OAuth secrets | 180 days | OVERDUE >210d|
ROTATION STEPS:
1. Generate new credential
2. Store in secret manager (new version)
3. Update app (auto if vault, deploy if env)
4. Verify app works with new credential
5. Revoke old (after 24h grace period)
ACCESS CONTROL:
- Each service has own identity (AppRole/IAM)
- Services access only their own secrets
- Human access requires MFA and is logged
- Production secrets never accessed directly
- Access logs retained 90+ days
- Alerts on anomalous access patterns
# Install gitleaks pre-commit hook
cat >> .pre-commit-config.yaml << 'EOF'
repos:
- repo: https://github.com/gitleaks/gitleaks
rev: v8.18.0
hooks:
- id: gitleaks
EOF
pre-commit install
SECRETS AUDIT:
Inventoried: <N>
Managed (vault): <N>
In .env (local): <N>
LEAKED: <N>
Rotation overdue: <N>
Pre-commit hook: ACTIVE | MISSING
Verdict: SECURE | NEEDS ROTATION | LEAKS FOUND
Commit: "secrets: <N> managed, <N> leaks fixed"
ls .env .env.local .env.production 2>/dev/null
grep -q "\.env" .gitignore 2>/dev/null || echo "CRITICAL"
grep -r "vault\|aws-sdk.*secrets\|@google-cloud/secret" \
package.json pyproject.toml 2>/dev/null
Log to .godmode/secrets-audit.tsv:
timestamp\ttotal\tmanaged\tleaked\trotation_overdue\tverdict
KEEP if: verified real credential in production code
DISCARD if: false positive (placeholder, public key)
OR already remediated in previous iteration
STOP when:
- Zero verified leaks in code and git history
- Pre-commit hook installed and active
- All production secrets in vault
- User requests stop