secret-hygiene

Secret Hygiene

A practical workflow for credential management: detecting leaks, rotating cleanly, and preventing recurrence.

When to invoke

• A secret was committed to git, or a private repo went public
• A contributor leaves the project, or access scope changes
• A credential turned up in a public dump, paste, or leak feed
• Periodic audit (quarterly is reasonable)
• Onboarding a repo, hosting account, or VPS you inherited

Step 1 — Inventory what you have

You cannot rotate secrets you cannot enumerate. Build a list, even a rough one.

- Hosting panel: <provider>     creds in: 1Password vault X
- DB user: <name>               creds in: server .env, 1Password
- API keys:
    - Stripe live + test        creds in: backend .env, Stripe dashboard
    - Mailgun                   creds in: backend .env
    - GitHub PAT                creds in: ~/.gitconfig (BAD — move to keychain)
- SSH keys: ~/.ssh/id_*         on machines: workstation, CI, VPS
- CI secrets: GitHub Actions    visible at: repo/settings/secrets

Keep this in a password manager or a private repo — never in plaintext on disk.

Step 2 — Scan for leaks (local + repos)

Local filesystem

# Files commonly containing secrets
find ~/Code -maxdepth 4 -type f \( -name '.env*' -o -name 'credentials*' -o -name 'secrets*' \) -not -path '*/node_modules/*' 2>/dev/null

# Permissions check — .env should be 600
find ~/Code -name '.env*' -not -path '*/node_modules/*' -exec stat -f '%Lp %N' {} \; 2>/dev/null

# Did you commit a .env by accident?
cd ~/Code/<repo>
git log --all --full-history -- '.env*' 2>/dev/null

Git history

# Quick grep across all history for high-signal patterns
git log -p --all -S 'AKIA'        # AWS access key
git log -p --all -S 'sk-'         # OpenAI / many SaaS
git log -p --all -S 'ghp_'        # GitHub PAT
git log -p --all -S 'xoxb-'       # Slack bot token
git log -p --all -S 'BEGIN RSA PRIVATE KEY'
git log -p --all -S 'BEGIN OPENSSH PRIVATE KEY'

# Better: dedicated scanners
gitleaks detect --source . --report-format json --report-path gitleaks.json
trufflehog git file://. --json