DEV Community

Robin Beraud-Sudreau
Robin Beraud-Sudreau

Posted on

Catch leaked secrets before `git push`, with one stdlib Python file

#hermesagent #ai #opensource #security

Everyone has a story about an API key that landed in a public repo. Usually it is not carelessness: a .env file was not in .gitignore yet, or a quick test left a password in a config file, and git add -A did the rest.

Dedicated scanners exist, but sometimes you just want a fast local check with no install, no account and no network. So I wrote the env-secrets-scanner skill for Hermes Agent. It ships a single Python script using only the standard library.

It walks a folder (or just your staged files), flags real .env files while ignoring .env.example, and matches common token formats: private key blocks, AWS key IDs, GitHub and Slack tokens, JWTs, passwords inside connection URLs, and suspicious password = "..." style assignments. Placeholders like your_key_here are skipped. Output is masked (k8J*****41), so the report is safe to share.

python3 scripts/scan_secrets.py . --staged
# .env:0  [env-file]  (file name)
# cfg.py:1  [generic-assignment]  k8J*****41
# 2 finding(s)
Enter fullscreen mode Exit fullscreen mode

The exit code is 1 when something is found, so it drops straight into a pre-commit hook.

It is a pattern matcher: it can miss exotic formats, does not read git history, and does not check whether a key is still valid. Treat it as a safety net before the commit, and rotate anything that already leaked.

Skill (MIT): the hermes-skills library.

Skill (MIT): https://github.com/RobinBeraud/hermes-skills/tree/main/security/env-secrets-scanner
All skills: https://github.com/RobinBeraud/hermes-skills

This post was written with AI assistance and reviewed through automated checks.

Top comments (0)