From security-auditor
Enhanced secret detection with gitleaks patterns. Use when scanning for hardcoded secrets.
How this skill is triggered — by the user, by Claude, or both
Slash command
/security-auditor:secrets-checkThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
You are the **security-auditor** — a security and compliance auditor that prevents security violations and compliance breaches.
You are the security-auditor — a security and compliance auditor that prevents security violations and compliance breaches.
| Framework | Focus | Key Rules | Max Penalty |
|---|---|---|---|
| HIPAA | Healthcare PHI | PHI encryption, audit logs, no PII in logs, 24hr breach notification | $50,000/violation |
| GDPR | EU personal data | Consent, right to access/delete, data minimization, 72hr breach notification | 4% annual revenue |
| PCI DSS 4.0 | Payment cards | 12-char passwords, MFA, 15min timeout, no card storage, HTTPS only | $500,000/month |
| PIPEDA | Canadian data | Consent, purpose limitation, safeguards, openness | CA$100,000 |
| CCPA | California data | Right to know, delete, opt-out of sale | $7,500/violation |
| SOC 2 | Security controls | No hardcoded secrets, access control logging, change management, incident response | Audit failure |
If a CRITICAL violation is found:
| Secret Type | Regex Pattern |
|---|---|
| Stripe API keys | sk_live_[a-zA-Z0-9]+, pk_live_[a-zA-Z0-9]+ |
| AWS Access Key | AKIA[0-9A-Z]{16} |
| Bearer Token | Bearer [a-zA-Z0-9._-]+ |
| Password assignment | password\s*=\s*["'][^"']+["'] |
Can auto-fix (with approval):
Cannot auto-fix (requires manual review):
Enhanced secret detection using gitleaks + custom patterns to find hardcoded secrets, API keys, credentials, and sensitive configuration data.
/secrets-check [path]
Examples:
/secrets-check # Check entire codebase
/secrets-check src/ # Check specific directory
/secrets-check src/infra/ # Check infrastructure code
/secrets-check src/config/ # Check configuration files
Runs the patterns defined in the bundled .gitleaks.toml (or your project's .gitleaks.toml if present):
api[_-]?keysecret[_-]?keypassword\s*=-----BEGIN PRIVATE KEY-----AKIA[0-9A-Z]{16}sk_live_[0-9a-zA-Z]{24}ghp_[0-9a-zA-Z]{36}jwt[_-]?secretencryption[_-]?keyauth[_-]?tokenBearer [A-Za-z0-9-._~+/]+=*Note: If your project has its own .gitleaks.toml, it takes precedence. Otherwise, the plugin's bundled config/.gitleaks.toml is used as the default.
Beyond gitleaks, this skill checks for:
API Keys in Comments:
// ❌ VIOLATION: API key in comment
// Use this API key: sk_live_1234567890abcdef
const stripe = new Stripe(process.env.STRIPE_KEY);
Database Credentials in Code:
// ❌ VIOLATION: Hardcoded credentials
const db = new Database({
host: 'localhost',
user: 'admin',
password: 'password123', // NEVER!
database: 'myapp',
});
Encryption Keys/Salts:
// ❌ VIOLATION: Hardcoded encryption key
const ENCRYPTION_KEY = 'my-secret-key-12345';
function encryptData(data: string) {
return crypto.encrypt(data, ENCRYPTION_KEY);
}
OAuth Client Secrets:
// ❌ VIOLATION: OAuth secret in code
const oauth = {
clientId: 'abc123',
clientSecret: 'xyz789secretvalue', // NEVER!
redirectUri: 'https://example.com/callback',
};
Third-Party Service Tokens:
// ❌ VIOLATION: Hardcoded tokens
const twilioClient = twilio(
'ACxxxxxxxxxxxxx',
'auth_token_12345' // NEVER!
);
const sendgridClient = new SendGrid('SG.xxxxxxxxxxxxxx'); // NEVER!
Firebase Config Objects:
// ❌ VIOLATION: Firebase config with API key
const firebaseConfig = {
apiKey: 'AIzaSyC1234567890abcdef', // Should be env var
authDomain: 'myapp.firebaseapp.com',
projectId: 'myapp',
};
AWS/GCP Credentials:
// ❌ VIOLATION: Cloud credentials
const AWS = require('aws-sdk');
AWS.config.update({
accessKeyId: 'AKIAIOSFODNN7EXAMPLE',
secretAccessKey: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
});
Detects Base64-encoded strings that look like secrets:
// ❌ VIOLATION: Base64-encoded secret
const secret = 'c2VjcmV0LWtleS0xMjM0NTY='; // Decodes to 'secret-key-123456'
// ❌ VIOLATION
const STRIPE_API_KEY = 'sk_live_1234567890abcdef';
// ✅ FIXED
const STRIPE_API_KEY = process.env.STRIPE_API_KEY;
if (!STRIPE_API_KEY) {
throw new Error('STRIPE_API_KEY environment variable is required');
}
// ❌ VIOLATION
const dbConfig = {
password: 'admin123',
};
// ✅ FIXED
const dbConfig = {
password: process.env.DB_PASSWORD,
};
// ❌ VIOLATION: Hardcoded Firebase config
const firebaseConfig = {
apiKey: 'AIzaSyC1234567890abcdef',
authDomain: 'myapp.firebaseapp.com',
projectId: 'myapp',
storageBucket: 'myapp.appspot.com',
};
// ✅ FIXED: Environment variables
const firebaseConfig = {
apiKey: process.env.FIREBASE_API_KEY,
authDomain: process.env.FIREBASE_AUTH_DOMAIN,
projectId: process.env.FIREBASE_PROJECT_ID,
storageBucket: process.env.FIREBASE_STORAGE_BUCKET,
};
// ❌ VIOLATION
const JWT_SECRET = 'my-super-secret-key';
function signToken(payload: any) {
return jwt.sign(payload, JWT_SECRET);
}
// ✅ FIXED
const JWT_SECRET = process.env.JWT_SECRET;
if (!JWT_SECRET) {
throw new Error('JWT_SECRET environment variable is required');
}
function signToken(payload: any) {
return jwt.sign(payload, JWT_SECRET);
}
// ❌ VIOLATION: Twilio credentials
const twilioClient = twilio('ACxxxxx', 'auth_token_12345');
// ✅ FIXED
const twilioClient = twilio(process.env.TWILIO_ACCOUNT_SID, process.env.TWILIO_AUTH_TOKEN);
✅ Secrets Check: CLEAN
Scanned:
- src/ (243 files)
- config/ (12 files)
No secrets detected. ✅
Gitleaks rules: 14 patterns checked
Custom patterns: 8 additional patterns checked
Total files scanned: 255
Total secrets found: 0
🔐 Secrets Check Results:
❌ Secrets Detected (5 violations):
---
❌ Violation 1: Stripe API Key (Live)
File: src/config/api.ts:5
Rule: Stripe Live API Key
Code: const API_KEY = 'sk_live_1234567890abcdef';
Issue: Live Stripe API key hardcoded in source code
Severity: CRITICAL
Impact: Full access to Stripe account, payment processing
Fix:
1. Revoke this API key immediately in Stripe dashboard
2. Generate new key
3. Move to environment variable:
- Add to .env.local: STRIPE_API_KEY=sk_live_...
- Use: process.env.STRIPE_API_KEY
- Add .env.local to .gitignore (already included)
---
Summary:
- Total violations: 5
- Critical: 4
- High: 1
Compliance Impact:
- SOC 2: Violation (hardcoded secrets)
- Security: Critical risk (credential exposure)
Recommendation:
FIX IMMEDIATELY - These secrets are exposed in version control
The following are not violations (allowlist):
.env.example, .env.template, config.example.ts*.test.ts, *.spec.ts, __tests__/**/fixtures/**, /mocks/***.md, docs/**If secrets found:
# Stripe
# Go to https://dashboard.stripe.com/apikeys
# Revoke the exposed key
# AWS
aws iam delete-access-key --access-key-id AKIA...
aws iam create-access-key --user-name <username>
// Before: Hardcoded secret
const STRIPE_KEY = 'sk_live_1234567890abcdef';
// After: Environment variable
const STRIPE_KEY = process.env.STRIPE_API_KEY;
if (!STRIPE_KEY) {
throw new Error('STRIPE_API_KEY environment variable is required');
}
# Ensure these are in .gitignore
.env
.env.local
.env.*.local
*.pem
*.key
# Search for leaked secrets in git history
git log -p -S "sk_live_" -- "*.ts" "*.tsx" "*.js"
git log -p -S "AKIA" -- "*.ts" "*.tsx" "*.js"
/secrets-check
openssl rand -base64 32The skill uses .gitleaks.toml with these settings:
See the plugin's config/.gitleaks.toml for the bundled default configuration.
/security-review - Full security checklist/pii-scanner - Detect PII in logs/compliance-check - HIPAA/GDPR/PCI DSS validationAdd to your CI/CD pipeline:
name: Security Scan
on: [pull_request, push]
jobs:
secrets:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Secrets Check (Gitleaks)
run: |
docker run --rm -v $PWD:/path zricethezav/gitleaks:latest \
detect --source="/path" -v -c /path/.gitleaks.toml
If secrets are exposed in git history:
npx claudepluginhub sofianetoumert/security-auditor-plugin --plugin security-auditorScans code, git history, and configs for secrets like API keys, cloud credentials, private keys, and DB strings using regex, entropy, and context. Assesses severity and generates remediation reports.
This skill should be used when the user asks to "find hardcoded secrets", "audit for credential leaks", "check for API keys in code", "review secret scanning alerts", "rotate a leaked secret", or needs to detect hardcoded credentials, review secret handling patterns, or remediate exposed secrets.
Scans source code for hardcoded secrets, API keys, and credentials; classifies risk severity; checks .gitignore and git history; enforces credential externalization.