ghas-secret-scanning

Secret Scanning Remediation

Overview

Remediate secrets detected by GitHub's secret scanning. Remove the leaked value, replace with a secure reference, and guide rotation.

CRITICAL: Never Echo Secrets

• NEVER include the actual secret value in logs, PR comments, commit messages, or subagent prompts
• ALWAYS redact to [REDACTED] before any output
• ONLY reference the secret by its type and location

Remediation Steps

1. Identify the secret type from the alert (AWS key, GitHub token, API key, DB password, etc.)
2. Remove the hardcoded secret from the code
3. Replace with a secure reference:
   • Environment variable: os.environ["SECRET_NAME"] / process.env.SECRET_NAME
   • AWS Secrets Manager: aws_secretsmanager_secret_version data source in Terraform
   • Azure Key Vault: azurerm_key_vault_secret data source
   • .env file (local dev only): add to .gitignore first
4. Rotate the secret — provide rotation instructions per type (see below)
5. Resolve the alert via gh api using ghas-api-interaction skill

Rotation Guidance by Secret Type

Secret Type	Rotation Steps
AWS Access Key	IAM Console → User → Security Credentials → Create new key → Delete old key
GitHub Personal Access Token	Settings → Developer Settings → Personal Access Tokens → Regenerate
GitHub App Key	App Settings → Generate new private key → Delete old key
Generic API Key	Contact service owner, generate new key in service dashboard
Database Password	Rotate via secrets manager, update connection strings
SSH Private Key	Generate new keypair, update authorized_keys on target hosts
Slack Webhook URL	Regenerate in Slack App Settings → Incoming Webhooks

Alert via Slack MCP

After remediation, send a Slack notification:

• Secret type and location (file path, NOT the value)
• Whether the secret has been rotated or requires manual rotation
• Link to the PR with the fix