domains / families / security / sast-hardcodedsecrets

sast-hardcodedsecrets

authentic

Detect hardcoded sensitive data (API keys, access tokens, private keys, passwords, etc.) in publicly accessible code — frontend JavaScript, mobile apps, client-side bundles, and HTML templates. Uses a three-phase approach: recon (find secret candidates), batched verify (confirm real secrets in public code paths, 3 candidates each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/hardcodedsecrets-results.md. Use when asked to find hardcoded secrets, leaked API keys, or exposed credentials.

When to use

• find hardcoded secrets
• leaked API keys
• exposed credentials
• frontend JavaScript secrets
• mobile app secrets
• client-side bundle secrets
• HTML template secrets

When not to use

• server-side application code
• server-side API route files
• environment files
• server-side configuration
• CI/CD pipeline files
• Docker/infrastructure files
• backend utility/service files
• test files

Skill page

Source