talforsherClaude Code
curl -fsSL https://raw.githubusercontent.com/vibe-md/vibe.md/7cb0620fbd80f9829155d8866328b58cd18d5aa7/scripts/install.sh \
| bash -s -- --skill secret-guard \
--agent claude-code --ref 7cb0620fbd80f9829155d8866328b58cd18d5aa7Secret Guard
AvailableKeeps credentials out of the repository by checking configuration files and staged changes for secrets before they are saved or pushed. Use when a project starts using API keys, tokens, or service credentials, before the first commit, and whenever configuration or authentication files change.
Keeps API keys, tokens and other credentials out of your repository. Your agent checks configuration files and staged changes for secrets before they are saved or pushed, and sets up the habits that keep them out for good.
Security
- Claude Code
- Codex CLI
- GitHub Copilot
- Cursor
- Gemini CLI
Maintained by
The problem
It takes one commit to put a key where anyone can find it. AI agents write and save code quickly, and a key pasted into a config file is easy to commit without noticing. Once it has been pushed, deleting it is not enough, because anyone who saw it can still use it.
What it does
Ignore first, write second
Makes sure the file that will hold a secret is in .gitignore before the secret is written, and offers a .env.example with placeholders.
Scans before you save or push
Checks staged and recent changes for common credential formats, such as AWS, Google, OpenAI, Stripe, GitHub and Slack keys, private keys and passwords in URLs.
Never repeats the secret
Reports the file, the line and the first four characters only, so the secret does not leak again into logs or chat.
Searches your history
Can search every past commit for a secret and report where and when it appeared.
Installation
One command
Install directly into your project.
Open Terminal in your project folder, then run this command. No ZIP, moving files, or prompt needed.
- 1Open your project folder in Terminal
- 2Run the command above
- 3Reload your agent and ask to use Secret Guard
Works on macOS, Linux, and Windows through WSL or Git Bash. The installer checks destinations and stops if existing files conflict.
Usage examples
Type these to your agent in plain language. Here's what to expect.
you › Add my OpenAI key so the app can call the API.
Expected workflow
- 01Confirms .gitignore covers .env.
- 02Creates .env.example with the same key and a placeholder.
- 03Writes the real key only into .env.
- 04Checks with git status that the env file is ignored and reports what will be committed.
you › Did I ever commit a Stripe key?
Expected workflow
- 01Searches the full Git history for Stripe live-key patterns.
- 02Reports the matching commits and dates without printing the values.
- 03Explains that if it was pushed, the key must be rotated at Stripe.
How it works
The skill starts by listing where your project keeps configuration, then makes sure secrets have an ignored home before any are written. Before each save or push it scans for credential patterns.
If a secret was never pushed, your agent moves it out of the code and into an environment variable. If it was pushed, the skill says plainly that the key is compromised and prepares the steps for you to rotate it.
Safety and limitations
Required permissions
- Read your configuration files, staged changes and Git history.
- Edit .gitignore and create example files.
Potentially destructive operations
Read what your agent is about to run before approving it. These can lose work:
- Rewriting Git history is only done with your explicit approval.
- A pre-commit hook is only added if you approve it.
Limitations
- It cannot rotate or revoke a key. That happens at the provider, and your agent will not contact any provider for you.
- Pattern checks catch common formats, not every possible secret.