secrets-scanner — Claude Code command: scan for secrets and install
Finds exposed API keys, passwords, certificates, and other sensitive data in a repository. Choose a scan focus or run a broader check.
npx claude-code-templates@latest --command security/secrets-scannerWhat secrets-scanner does
secrets-scanner searches code and configuration for exposed credentials, database connection details, private keys, JWT secrets, and internal endpoints. Pass a scope or use a flag to focus on API keys, passwords, or certificates.
Before scanning, it gathers Git status, counts matching file types, and checks recent commit messages for references to passwords, keys, secrets, or tokens. The resulting report lists file locations and line numbers, assigns risk levels, and suggests immediate actions. It can also propose .gitignore entries and secure configuration templates.
Install it with the npx command in the FAQ. The command uses Read, Bash, Grep, and Glob, and runs Git and find; those utilities need to be available for its checks.
What it helps with
- find API keys and tokens committed in source files
- locate database passwords and connection strings
- check project files for private keys and certificates
- produce a risk-ranked report with file locations
- draft
.gitignoreentries for sensitive files
Example prompts for the agent
- Scan the repository for exposed secrets with
/secrets-scanner. - Check the project for API keys and tokens using
/secrets-scanner --api-keys. - Look for passwords and suggest safer storage with
/secrets-scanner --passwords.
How to install secrets-scanner
1claude-code-templates
npx claude-code-templates@latest --command security/secrets-scanner2Manually: put the files in place
.claude/commands/secrets-scanner.mdCall it with /secrets-scanner. For all projects use ~/.claude/commands/
Manually: put the files in place
~/.codex/prompts/secrets-scanner.mdCall it with /prompts:secrets-scanner. Codex marks this format deprecated in favour of skills
Manually: put the files in place
.github/prompts/secrets-scanner.prompt.mdManually: put the files in place
.gemini/commands/secrets-scanner.tomlGemini stores commands as TOML: the prompt text goes into the prompt field
Questions about secrets-scanner
How do I install secrets-scanner in Claude Code?
Run npx claude-code-templates@latest --command security/secrets-scanner. The command is installed at .claude/commands/secrets-scanner.md.
What does secrets-scanner do?
It searches code and configuration for exposed secrets, then reports file locations, line numbers, risk levels, and remediation steps.
Can I limit a scan to API keys or certificates?
Yes. Use --api-keys to focus on API keys or --certificates for certificates. The command also accepts --passwords and --fix.
Source text
secrets-scanner.md · MIT
--- allowed-tools: Read, Bash, Grep, Glob argument-hint: "[scope] | --api-keys | --passwords | --certificates | --fix" description: Scan codebase for exposed secrets, credentials, and sensitive information --- # Secrets Scanner Scan codebase for exposed secrets and sensitive information: **$ARGUMENTS** ## Current Repository State - Git status: !`git status --porcelain | wc -l` uncommitted files - File types: !`find . -name "*.js" -o -name "*.py" -o -name "*.env*" -o -name "*.yml" | wc -l` scannables - Recent commits: !`git log --oneline --grep="password\|key\|secret\|token" -5` - Environment files: @.env* or @config/* (if exists) ## Task Perform comprehensive secrets detection and remediation across codebase: **Scan Scope**: Use $ARGUMENTS to focus on API keys, passwords, certificates, or complete scan **Detection Categories**: 1. **API Keys & Tokens** - GitHub, AWS, Google Cloud, Stripe, third-party services 2. **Database Credentials** - Connection strings, usernames, passwords 3. **Certificates & Keys** - Private keys, SSH keys, SSL certificates 4. **Authentication Secrets** - JWT secrets, session keys, OAuth credentials 5. **Configuration Leaks** - Hardcoded URLs, internal endpoints, debug settings **Remediation Actions**: - Identify exposed secrets with file locations and line numbers - Provide secure alternatives (environment variables, secret management) - Generate .gitignore entries for sensitive files - Create secure configuration templates - Implement secrets management best practices **Output**: Detailed security report with risk levels, immediate actions, and long-term security improvements.
© davila7 · MIT · davila7/claude-code-templates
