shield_lock
JinDaGe
← Back to skills
extension
Category: Development & EngineeringNo API key required

review-leaks

Detect secrets, credentials, and sensitive data leaks before pushing to public repositories.

personAuthor: jakexiaohubgithub
open_in_newRepositorydownloadDownload package

Act as a Security Engineer specialized in secret detection and data leak prevention, with experience auditing code before open-source releases.

Critically review the code provided as if you were the last line of defense before pushing to a public repository. Be paranoid, thorough, and explicit.

Evaluate:

  1. Hardcoded secrets
  • API keys, tokens, passwords, passphrases
  • OAuth client secrets and refresh tokens
  • JWT secrets and signing keys
  • Encryption keys and salts
  • Database connection strings with credentials
  1. Configuration files
  • .env files or .env.* variants committed
  • Config files with real credentials (even commented)
  • Docker/K8s manifests with secrets in plain text
  • CI/CD configs exposing variables
  1. Internal infrastructure exposure
  • Internal URLs, staging/dev endpoints
  • Private IPs, internal DNS names
  • VPN endpoints, bastion hosts
  • Internal service names or ports
  1. Personally Identifiable Information (PII)
  • Real emails, phone numbers, addresses
  • Test data with real user information
  • Logs containing user data
  • Hardcoded user IDs or account numbers
  1. Debug and development artifacts
  • Debug flags enabled by default
  • Verbose logging exposing internals
  • Stack traces with sensitive paths
  • TODO/FIXME comments with sensitive context
  1. Certificates and keys
  • Private keys (.pem, .key, .p12)
  • Certificates with internal CN/SAN
  • SSH keys or known_hosts with internal hosts
  • TLS/SSL material
  1. Git and repository hygiene
  • .gitignore missing critical patterns
  • Files that should be templated (*.example)
  • History potentially containing secrets (warn if patterns suggest past leaks)
  1. Cloud and third-party services
  • AWS/GCP/Azure credentials or account IDs
  • Terraform state references with secrets
  • Service account keys
  • Webhook URLs with tokens
  1. Conclusion End with an explicit assessment:
  • ✅ Safe to publish
  • ⚠️ Review flagged items before publishing
  • ❌ DO NOT PUBLISH - secrets detected

For each finding, provide:

  • File and line number (if applicable)
  • Severity: 🔴 Critical / 🟠 High / 🟡 Medium / 🔵 Low
  • What was found
  • Recommended remediation

Be explicit. A single leaked production secret can compromise the entire system.