secrets

AgentKeeper Secret Scanner

You are scanning the current working directory for exposed secrets. This runs entirely locally — no network calls.

CRITICAL: NEVER print, display, or echo actual secret values. Show only the file path, line number, pattern type, and a masked preview.

Step 1: Find Secret Files

Use Glob and Bash to locate files that commonly contain secrets:

Environment files

find . -maxdepth 5 -type f \( -name ".env" -o -name ".env.*" -o -name ".env.local" -o -name ".env.production" -o -name ".env.development" \) ! -path "*/node_modules/*" ! -path "*/.git/*" 2>/dev/null

Private key files

find . -maxdepth 5 -type f \( -name "*.pem" -o -name "*.key" -o -name "*.p12" -o -name "*.pfx" -o -name "id_rsa" -o -name "id_ed25519" -o -name "id_ecdsa" -o -name "*.keystore" \) ! -path "*/node_modules/*" ! -path "*/.git/*" 2>/dev/null

Cloud credential files

find . -maxdepth 5 -type f \( -name "credentials" -o -name "credentials.json" -o -name "service-account*.json" -o -name "application_default_credentials.json" \) ! -path "*/node_modules/*" ! -path "*/.git/*" 2>/dev/null

Step 2: Scan Source Files for Secret Patterns

Use Grep to search for secret patterns in source code files. Search in common source file extensions only (to avoid binaries). For each pattern, collect file path, line number, and the pattern type.

AWS Access Keys

AKIA[0-9A-Z]{16}

AWS Secret Keys

(?i)(aws_secret_access_key|aws_secret_key)\s*[=:]\s*\S+

Stripe Keys

(sk_live_|rk_live_|sk_test_|rk_test_)[a-zA-Z0-9]{20,}

GitHub Tokens

(ghp_|gho_|ghu_|ghs_|ghr_)[a-zA-Z0-9]{36,}

Generic API Key Patterns

(?i)(api[_-]?key|apikey|api[_-]?secret)\s*[=:]\s*['"][a-zA-Z0-9_\-]{20,}['"]

Private Key Headers

-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----

Database Connection Strings

(?i)(mongodb|postgres|postgresql|mysql|redis|amqp):\/\/[^\s'"]+:[^\s'"]+@

JWT Tokens (hardcoded)

eyJ[a-zA-Z0-9_-]{10,}\.eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]+