360 Secure SkillHub
360 安全技能中心

secrets-scan

提供自动化扫描、手动模式匹配、上下文研判和预防控制检查，输出脱敏发现、扫描摘要及必要时的凭据轮换建议；引用的流程文件与发现模板未随包提供。

分类：安全
OWASP
热度 0.00
最近更新 2026-10-29 17:17:55

安装

发给 Agent
帮我安装这个技能：npx secure-skills-cli add owasp/secure-agent-playbook/secrets-scan
兼容性
通用兼容
联网要求
不联网
数据出网
数据不出本机
Metadata
name
secrets-scan
description
Detect hardcoded credentials, API keys, tokens, and secrets in source code and configuration files. Use when reviewing code for leaked secrets before commit/merge, auditing a repository for credential exposure, or setting up secret detection.
license
CC-BY-4.0

Secrets Scan

Detect hardcoded secrets by following the full procedure in plays/secrets-scan.md.

Steps

  1. Run Automated Scanner — Use available tools in preference order:

    • trufflehog filesystem --directory=<path> --json (recommended)
    • trufflehog git file://<repo> --json (includes git history)
    • gitleaks detect --source=<path> --report-format=json
    • detect-secrets scan <path> --all-files
    • If no scanner available, proceed with manual pattern analysis.

  2. Manual Pattern Analysis — Search for high-confidence patterns:

    • AWS keys (AKIA...), OpenAI (sk-...), Anthropic (sk-ant-...), GitHub (ghp_...), Slack (xoxb-...), Stripe (sk_live_...), SendGrid (SG.)
    • Connection strings with embedded passwords (://user:pass@host)
    • Private keys (PEM headers), JWT secrets, database credentials
    • High-risk files: .env, docker-compose*.yml, *.tfvars, terraform.tfstate, kubeconfig, .npmrc, .pypirc

  3. Contextual Analysis — For each detection: Is it real (not a placeholder/test fixture)? Is it active? What's the blast radius (service, permissions, prod vs dev, exposure duration)?

  4. Check Preventive Controls — Verify: .gitignore covers sensitive files, pre-commit hooks for secret scanning, CI pipeline scanning, secrets management documentation.

Important: Never include actual secret values in findings. Show redacted versions only (e.g., AKIA****EXAMPLE). Active production secrets require immediate rotation.

Output

Scan summary, findings using templates/finding.md, preventive controls checklist, and immediate rotation actions if needed.

OWASP References

  • A07:2021: Identification and Authentication Failures
  • CWE-798: Use of Hard-coded Credentials
  • CWE-312: Cleartext Storage of Sensitive Information