Detect and Manage Secrets in Code

This skill is expert in creating, optimizing, and managing secrets detection rules for identifying credentials, API keys, tokens, and other secrets in source code, config files, and repositories, covering pattern matching, regex optimization, false positive reduction, and coverage across secret types. Its core principles prioritize precision over recall to minimize false positives, use Shannon entropy analysis for generic secret detection, apply contextual validation where possible, and account for secret format and encoding variations. It covers rule categories with concrete regex patterns for AWS access keys and secret keys (with entropy thresholds and confidence levels), generic high-entropy API keys and bearer tokens, and PostgreSQL/MongoDB connection string patterns. It implements entropy-based detection via a Shannon entropy calculation function with a configurable threshold, context-aware JWT validation checking header/payload/signature structure, and service-specific very-high-confidence patterns for GitHub personal access tokens, GitHub OAuth tokens, Slack bot tokens, and Slack webhook URLs.

Use this skill when building or tuning secrets-detection rules for a scanning tool or CI/CD pipeline that needs both high coverage and low false-positive rates, not a naive regex-only approach. It defines a comprehensive rule structure combining pattern matching, entropy thresholds, keyword proximity requirements, confidence and severity scoring, and post-processing validation endpoints. Its false-positive reduction relies on explicit whitelist patterns (common placeholders like YOUR_API_KEY_HERE, test/dummy values, sequential hex strings) and path-based exclusions (docs, test directories, build artifacts like node_modules and dist). It covers performance optimization for scanning at scale - atomic groups and possessive quantifiers to prevent regex backtracking, anchored patterns, phased scanning (high-confidence rules first, low-confidence rules last), and resource limits (max file size, per-file timeout, thread pool size). It is not meant for a single ad hoc grep for secrets - the whole design is a tunable rule engine with confidence tiers and exclusions meant to run repeatedly in CI.

github_pat:
  pattern: 'ghp_[A-Za-z0-9]{36}'
  confidence: very_high
  description: 'GitHub Personal Access Token'

github_oauth:
  pattern: 'gho_[A-Za-z0-9]{36}'
  confidence: very_high
  description: 'GitHub OAuth Access Token'

slack_bot_token:
  pattern: 'xoxb-[0-9]+-[0-9]+-[A-Za-z0-9]+'
  confidence: very_high
  description: 'Slack Bot User OAuth Access Token'

slack_webhook:
  pattern: 'https://hooks\.slack\.com/services/[A-Z0-9]{9}/[A-Z0-9]{9}/[A-Za-z0-9]{24}'
  confidence: very_high
  description: 'Slack Incoming Webhook URL'

Given a codebase and its stack, the skill produces a rules configuration file with patterns like the ones above per secret type, entropy and keyword-proximity thresholds, whitelist and path-exclusion lists, and a scan configuration defining phased scanning and resource limits. It also produces a CI/CD integration example (a GitHub Actions step running a secrets-detector CLI with a SARIF report output and a fail-on-high-severity gate).

Security and platform engineers building or tuning secrets-detection rules for source code scanning who need both broad coverage and controlled false-positive rates rather than a single generic regex. It suits teams running scans in CI/CD who need performance-optimized patterns at scale, confidence-tiered rules for prioritized review, and ongoing rule maintenance - updating patterns for new services, monitoring false-positive rates, and testing against known secret datasets.