DEV Community

Robin Beraud-Sudreau
Robin Beraud-Sudreau

Posted on

Keep Secrets Out of Git: Introducing env-secrets-scanner for Hermes AI

#hermes #ai #automation #opensource

Keep Secrets Out of Git: Introducing env-secrets-scanner for Hermes AI

The Problem

Accidentally committing secrets is one of the most common security mistakes in software development. A forgotten .env file, an API key hardcoded in a script, or credentials embedded in a URL can silently slip into your git history—and once it's there, it's there forever. Even if you delete it later, anyone with access to the repository can still find it by browsing the commit history.

env-secrets-scanner solves this problem by scanning your project before you commit, catching leaked secrets before they reach your repository.

How It Works

env-secrets-scanner is a lightweight Python scanner (Python 3.8+, standard library only) that runs offline with zero external dependencies. It detects:

  • Real .env files and key files (*.pem, *.key, id_rsa)
  • Private key blocks, AWS keys, GitHub tokens, Slack tokens, and Stripe keys
  • Credentials embedded in URLs (scheme://user:password@host)
  • Suspicious variable assignments like password = "..."

The best part? All findings are masked in the output, so the report itself is safe to share in a chat or ticket without exposing sensitive data.

# Scan your entire project
python3 scripts/scan_secrets.py /path/to/project

# Check only staged files before committing
python3 scripts/scan_secrets.py /path/to/repo --staged

# Get machine-readable JSON output
python3 scripts/scan_secrets.py . --json
Enter fullscreen mode Exit fullscreen mode

Exit codes make it perfect for git hooks: 0 (clean), 1 (findings), 2 (usage error).

Using It with Hermes AI

The env-secrets-scanner skill integrates seamlessly into your Hermes AI agent workflow. Before pushing code or asking your AI assistant to review sensitive code, run the scanner as a security checkpoint. You can invoke it as a pre-commit skill to automatically scan staged files, or use it interactively when inheriting a new project.

If you encounter a false positive (like a deliberately exposed example password), simply add secretscan:ignore in a comment on that line.

Getting Started

The skill is available in the hermes-skills open-source repository. It requires only Python 3.8+ with no external dependencies—perfect for CI/CD pipelines and local development workflows alike.

Whether you're securing a brand-new project or auditing an inherited codebase, env-secrets-scanner gives you peace of mind before every commit.

Ready to keep your secrets safe? Star the project at https://github.com/RobinBeraud/hermes-skills and add this skill to your workflow today.

Top comments (0)