infisical-scan

Infisical Scan Command

Scan the codebase for exposed secrets, API keys, and hardcoded credentials.

Parse Arguments

Extract from user input:

• mode: directory (default), git-history, or staged

Workflow

Step 1: Check CLI Available

which infisical && infisical --version

Step 2: Choose Scan Mode

Ask the user which scan to run:

1. Directory Scan - Scan all files in current directory
2. Git History Scan - Scan git commit history for leaked secrets
3. Staged Only - Scan only staged files (pre-commit check)

Step 3a: Directory Scan

# Scan current directory
infisical scan

# Scan specific path
infisical scan --path=./src

# Scan with verbose output
infisical scan -v

Step 3b: Git History Scan

# Scan all git history
infisical scan git-changes

# Scan recent changes only
infisical scan git-changes --staged

Step 3c: Staged Files Only

# Scan only staged files (ideal for pre-commit)
infisical scan git-changes --staged

Step 4: Analyze Results

Review scan output and categorize findings by severity:

• Critical: AWS keys, database connection strings, private keys, tokens with write access
• High: API keys, OAuth secrets, webhook secrets
• Medium: Internal URLs, non-production credentials
• Low: Example/placeholder values that look like secrets

Step 5: Remediate Findings

For each real secret found:

1. Move to Infisical:

   infisical secrets set LEAKED_KEY=<actual-value> --env=dev
   

2. Remove from code and replace with environment variable:

   # Before (hardcoded)
   api_key = "sk_live_abc123"
   
   # After (from environment)
   api_key = os.environ["API_KEY"]
   

3. Rotate the credential - any secret found in git history should be considered compromised:

   • Regenerate the key/token in the provider's dashboard
   • Update the new value in Infisical
   • Revoke the old credential

4. Verify cleanup:

   infisical scan