> ## Documentation Index
> Fetch the complete documentation index at: https://chatcli.edilsonfreitas.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets Scan (@secrets)

> Finds leaked credentials in a tree, a file, the staged git index or inline text — 17 rules plus an entropy check, every value redacted in the report.

The **`@secrets`** tool is what a reviewer runs before a commit: it scans a file, a directory tree, the files staged in git, or inline text for leaked credentials. It is pure Go, offline, workspace-bounded, and **never echoes a matched value in full** — findings carry the first four characters, an ellipsis and the length.

***

## Subcommands

```text theme={"system"}
<tool_call name="@secrets" args='{"cmd":"scan","args":{"path":"."}}' />
<tool_call name="@secrets" args='{"cmd":"scan","args":{"staged":true}}' />
<tool_call name="@secrets" args='{"cmd":"check","args":{"text":"export TOKEN=..."}}' />
<tool_call name="@secrets" args='{"cmd":"rules"}' />
```

### `scan {path?, include?, max_files?, staged?}`

Walks `path` (default `.`) without following symlinks, skipping `.git`, `node_modules`, `vendor`, `dist`, `build`, binaries and files above 1 MiB. `include` narrows by glob (e.g. `**/*.env`); `max_files` (default 5000) bounds the walk and the report says when it stopped early. `staged: true` scans only the files in the git index (`git diff --cached`), the pre-commit check.

### `check {text}`

Scans inline text — a snippet the agent is about to write, a pasted config.

### `rules`

Lists the rule ids with severity and description.

***

## Rules

AWS access key ids and secret keys, GitHub tokens (`ghp_`, `gho_`, `ghu_`, `ghs_`, `ghr_`, `github_pat_`), GitLab PATs, Slack tokens and webhooks, Google API keys, Stripe live keys, Twilio and SendGrid keys, `sk-` style API keys, JWTs, PEM private-key blocks, connection strings with an embedded password (postgres, mysql, mongodb, amqp, redis, mssql, jdbc), basic-auth URLs, generic `password|secret|token|api_key = "..."` assignments, and a **Shannon-entropy** check for long high-entropy strings assigned to secret-like names.

Placeholders are suppressed (`xxx`, `***`, `${VAR}`, `<...>`, `{{...}}`, `example`, `changeme`, `your_`, `dummy`, `sample`). A `.secretsignore` file (one glob or rule id per line) and an inline `secrets:ignore` marker on a line are honored.

***

## Output

```text theme={"system"}
2 finding(s): critical=1 high=1 medium=0 (files scanned=184, skipped=3)
config/prod.env:12 aws-secret-key critical wJal…(40 chars)
deploy/notes.md:40 generic-assignment high hunt…(24 chars)
```

When clean: `no secrets found (files scanned=184, skipped=3)`. The report is capped at 500 lines.

***

## Notes

* Read-only and concurrency-safe — it can run in parallel with other reads.
* Paths go through the same sensitive-path and workspace-boundary policy as `@read`.
* Pair it with [`@osv`](/security/dependency-scan) for dependencies and with `@forge pr-review` for a review checklist.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.