DEV Community

ke jia
ke jia

Posted on

Your CI Pipeline Is Missing This One-Step Secret Scan

#javascript #node #security #devops

Your CI pipeline probably runs tests, builds, and lints. It does not check whether a secret just got committed.

That gap is one line.

The Problem in One Sentence

Secrets do not get committed on purpose. They get committed in a hurry, in a "quick fix" branch, by an intern, by you at 6pm on a Friday — and CI, which saw every other line of the diff, saw the API_KEY=sk_live_... and said "build passed".

The One-Line Gate

DotGuard is a zero-dependency scanner for .env files. It walks a directory, finds every .env, and flags hardcoded passwords, API keys, access tokens, private keys, and database URLs.

The critical behavior for CI: it exits with code 1 when it finds potential secrets.

Add it to your pipeline:

# .github/workflows/ci.yml
steps:
  - uses: actions/checkout@v4
  - name: Scan for exposed secrets
    run: npx -y @wuchunjie/dotguard .
  - name: Tests
    run: npm test
Enter fullscreen mode Exit fullscreen mode

That is the whole change. No service to sign up for, no API key for the scanner (ironic, I know), no SaaS bill. One npx, zero dependencies, runs in seconds.

What It Catches

Finding Example
Hardcoded password PASSWORD=hunter2
API key API_KEY=sk_live_...
Access token TOKEN=ghp_...
Private key block BEGIN OPENSSH PRIVATE KEY
Database URL DATABASE_URL=postgres://user:pw@host/db
Long secret string any 20+ char quoted blob

It also notes missing basics like NODE_ENV — the kind of gap that turns into a 2am "why did it deploy to the wrong env" ticket.

The Right Order of Defense

CI scanning is the second gate, not the first:

  1. Pre-commit hook (catches it before it is committed) — DotGuard's exit code makes this a 5-line hook
  2. CI step (catches what the hook missed, or what came from a force-push)
  3. Rotation runbook (when one already escaped: rotate first, then clean history)

A repo with all three has essentially no realistic path for a .env to reach production via git. The first two are free; the third is just discipline.

Why Not the SaaS Scanner

The big secret-scanning platforms are fine for enterprise, and they cost money per seat. For the 95% case — "does my repo have a leaked .env?" — a local, zero-dependency scanner with an exit code is the entire job.

Ship the one line. Your pipeline stops being a secret leak detector that never detects.

npm: @wuchunjie/dotguard | GitHub: wuchunjie00/devtools

From the same toolbox

  • ScaffoldX — generate production-ready project templates in seconds: npx scaffoldx-cli
  • DotGuard — scan .env files for exposed secrets: npx @wuchunjie/dotguard
  • GitPulse — git analytics (commits, contributors, activity) in your terminal: npx @wuchunjie/gitpulse
  • SnippetX — save, search, and copy code snippets from the terminal: npx @wuchunjie/snippetx

GitHub: wuchunjie00/devtools

☕ If This Saved You Time

All of these tools are and will always be 100% free. If they make your day a little easier, consider fueling the next one:

Buy me a coffee on Ko-fi

Built with ❤️. Zero dependencies, zero tracking, zero bloat.

Top comments (0)