DEV Community

Robin Beraud-Sudreau
Robin Beraud-Sudreau

Posted on

Catch Secrets Before They're Committed: Meet the Env-Secrets-Scanner Skill

#hermes #ai #automation #opensource

Catch Secrets Before They're Committed: Meet the Env-Secrets-Scanner Skill

The Problem: Accidental Secret Leaks

One misplaced .env file, one forgotten API key in a config, and your credentials are in git history forever. Removing them later is painful—you'd need to rewrite commits, force-push, and notify your team. The env-secrets-scanner skill for Hermes AI catches these leaks before they happen, scanning your project for exposed secrets in seconds.

How It Works

The skill uses a lightweight Python scanner (no external dependencies, no API calls) to detect common secret patterns:

  • Real .env files and key files (.pem, .key, id_rsa)
  • Private key blocks and tokens (GitHub, Slack, Stripe, AWS, Google API, JWT)
  • Credentials in URLs like https://user:password@database.com
  • Assignments such as api_key = "sk_live_..." or TOKEN=secret

It intelligently skips safe files like .env.example and .env.sample, and ignores common build folders (.git, node_modules, venv).

# Scan your entire project
python3 scripts/scan_secrets.py /path/to/project

# Or just what's staged for commit
python3 scripts/scan_secrets.py /path/to/repo --staged
Enter fullscreen mode Exit fullscreen mode

The Safety Angle: Masked Output

Here's the clever part—all findings are masked in the report. Instead of showing your actual API key, it displays something like sk_live_****. This means you can safely share scan results in a Slack message, GitHub issue, or support ticket without exposing credentials.

Using It with Hermes

Integrate env-secrets-scanner into your Hermes workflow to automate security checks:

  1. Ask Hermes to scan a project before deployment
  2. Use it as a pre-commit hook to block unsafe commits
  3. Run it on inherited codebases to audit for leaks

Exit codes make it perfect for automation: 0 (clean), 1 (findings), 2 (error). Chain it into CI/CD or pre-commit workflows seamlessly.

Why It Matters

Security shouldn't require third-party services or API keys. This skill runs entirely offline with Python's standard library, making it fast, portable, and trustworthy. Whether you're working solo or across a team, catching secrets before they hit git history saves hours of damage control.

Ready to add security to your workflow? Check out the env-secrets-scanner skill and more at https://github.com/RobinBeraud/hermes-skills — and don't forget to star the repo!

Top comments (0)