Brewcode:Secrets Scan

Secrets Scan

<phase name="1-setup">

Phase 1: Setup

EXECUTE using Bash tool:

git rev-parse --is-inside-work-tree 2>/dev/null || { echo "ERROR: Not git repo"; exit 1; }
REPO=$(git rev-parse --show-toplevel) && cd "$REPO"
TS=$(date +%Y%m%d-%H%M%S)
DIR="$REPO/.claude/reports/${TS}_secrets-scan" && mkdir -p "$DIR"
git ls-files > "$DIR/files.txt"
echo "DIR=$DIR|REPO=$REPO|TS=$TS|TOTAL=$(wc -l < "$DIR/files.txt" | tr -d ' ')"
cat "$DIR/files.txt"

STOP if ERROR — must run in git repository.

</phase>

<phase name="2-parallel-scan">

Phase 2: Split & Launch 10 Agents

1. Parse file list → split into 10 chunks (ceil(total/10)) 2. Send 10 Task calls in parallel (single message)

Config: Task(subagent_type="general-purpose", model="haiku", description="Agent N/10 scan")

<agent-prompt> Agent {N}/10 secrets scanner.

FILES: {FILES}

Read each file → detect secrets → return JSON.

PATTERNS:

CRITICALITY:

SKIP: env refs (process.env.*, ${VAR}, os.getenv()), placeholders, docs/comments.

OUTPUT (JSON):

{"agent":{N},"scanned":["f1","f2"],"skipped":[{"path":"x","reason":"binary"}],"findings":[{"path":"f","line":1,"content":"pwd=x","desc":"Hardcoded pwd","crit":"HIGH"}]}

No findings: "findings":[] </agent-prompt>

</phase>

<phase name="3-merge">

Phase 3: Merge Results

1. Collect 10 JSON responses 2. Parse each (handle errors gracefully) 3. Merge scanned[], skipped[], findings[] 4. Dedupe by path+line 5. Sort: CRITICAL → HIGH → MEDIUM → LOW

</phase>

<phase name="4-report">

Phase 4: Generate Report

Write {DIR}/report.md:

<report-template>

Secrets Scan Report

Scan: {TS} | Repo: {REPO} | Files: {TOTAL} | Agents: 10

Summary

Findings

CRITICAL ({N})

{ROWS}

HIGH / MEDIUM / LOW

(same table format)

Agent Stats

File Inventory

Scanned ({N})

{ALL}

Skipped ({N})

{SKIP} </report-template>

</phase>

<phase name="5-summary">

Phase 5: Display Summary

## Secrets Scan Complete

| Metric | Value |
|--------|-------|
| Files | {N} |
| CRITICAL | {N} |
| HIGH | {N} |
| MEDIUM | {N} |
| LOW | {N} |

Report: {DIR}/report.md

</phase>

<phase name="6-fix">

Phase 6: Fix Mode

Trigger: --fix arg OR CRITICAL/HIGH findings exist → AskUserQuestion

</phase>

Secrets Scan

Scans all git-tracked files for secrets (passwords, API keys, tokens, private keys, DB credentials) using 10 parallel agents. Generates detailed report with findings by severity and full file inventory.

Invoke

/secrets-scan
/secrets-scan --fix

• No args: scan only, display report
• --fix: scan + interactive remediation (delete, move to env var, gitignore)

Usage Example

/secrets-scan

Outputs report to .claude/reports/{TIMESTAMP}_secrets-scan/report.md with:

• Summary table (file counts, severity breakdown)
• Finding details: file, line, content, description, criticality level
• Full inventory of scanned and skipped files
• Per-agent statistics

To remediate findings:

/secrets-scan --fix

Review each finding and choose: fix, move to env var, gitignore, skip, or mark false positive.

What It Detects

Passwords, API keys, access tokens, AWS credentials, database connection strings, private keys, encryption keys, hardcoded secrets with patterns like password=, api_key=, -----BEGIN PRIVATE KEY-----, etc.

Skips: env variable references, common placeholders (changeme, xxx, dummy), comments, binary files.

Reports

Report location: .claude/reports/{TIMESTAMP}_secrets-scan/report.md

Report includes:

• Summary metrics (scanned, skipped, findings by severity)
• Detailed findings table (path, line, content, description, level)
• Complete file inventory (scanned vs skipped)
• Agent processing statistics