check-secrets

Scan the codebase for potential secret leaks before commits.

Trigger Examples

• "Check for secrets"

• "Scan for leaks"

• "Security check"

• "Are there any hardcoded secrets?"

Execution Flow

1. Define Detection Patterns

High-risk patterns:

• API keys: ['"]?[A-Z0-9_]{20,}['"]?

• Bearer tokens: Bearer\s+[A-Za-z0-9-._~+/]+=*

• Private keys: -----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY-----

• OAuth secrets: client_secret['"]?\s*[:=]\s*['"]?[A-Za-z0-9-_]{20,}

• GCP service account keys: "type":\s*"service_account"

• AWS credentials: AKIA[0-9A-Z]{16}

Project-specific patterns:

• Hardcoded project IDs: koborin-ai (outside of variable assignments or docs)

• Email addresses: @koborin.ai

Safe patterns (excluded):

• Environment variable references: process.env. , ${ , TF_VAR_

• Placeholder values: <PROJECT_ID> , YOUR_API_KEY , dummy , example

• Test fixtures: files under tests/ , *.test.ts , *.spec.ts

2. Scan the Codebase

Use git ls-files to get tracked files:

git ls-files | grep -v -E '.(png|jpg|jpeg|gif|svg|woff|woff2|ttf|eot|ico|pdf)$' |
grep -v -E '^(node_modules|.next|dist|build|coverage)/'

3. Filter False Positives

Remove known safe occurrences:

• Lines containing process.env. or TF_VAR_

• Template files (.env.example , .env.template )

• Lines with placeholder patterns (<...> , YOUR_... , REPLACE_ME )

4. Categorize Findings

Critical (immediate action required):

• Private keys, service account JSON

• Hardcoded passwords or tokens

• Real API keys with valid format

Warning (review recommended):

• Suspicious long strings that might be keys

• Hardcoded project IDs outside infrastructure code

Info (low risk):

• Company name in unexpected places

• Domain references in application code

5. Display Results

CRITICAL: Potential private key detected File: infra/shared/main.tf Line: 42 Match: -----BEGIN PRIVATE KEY-----

WARNING: Hardcoded project ID File: app/src/lib/api-client.ts Line: 15 Match: const PROJECT = "koborin-ai"

Summary:

• Critical: 1 finding(s)
• Warning: 1 finding(s)

Review these findings before committing.

Project-Specific Rules

For koborin-ai :

• Allow koborin-ai in infra/ and README.md

• Flag it in app/src/ unless from environment variable

• Allow email addresses in documentation

• Flag GCP project IDs when hardcoded outside Pulumi config

Notes

• This is static analysis only; cannot detect runtime-loaded secrets

• Always review findings manually

• Run before every commit

• Never commit real secrets even if undetected