Env-Secrets-Scanner Skill Flags Exposed Credentials Before They Reach Git

·9 views

A new env-secrets-scanner skill for Hermes AI is designed to catch leaked credentials such as .env files, private keys, and API tokens before they are committed to a repository. It uses a dependency-free Python script that runs offline and detects common secret patterns, including GitHub, Slack, Stripe, AWS, Google, and JWT tokens, as well as credentials embedded in URLs. The tool skips template files like .env.example and ignores build folders, and it masks any findings in its report so results can be shared safely. Developers can run it on a whole project, only staged changes, or as a pre-commit hook, with exit codes suited to CI/CD pipelines. The skill is available on GitHub through the hermes-skills repository.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why Every Engineering Project Must First Justify Its Existence

The article argues that before any architecture or deployment work begins, teams should ask whether a given artifact needs to exist at all. It uses an apple as an analogy, noting that the eaten fruit rests on a vast web of trees, pollinators, farming, transport, and digestion that is easy to overlook. The author suggests that judging a system by its visible output alone understates the dependencies beneath it. The same reasoning applies to small software tools, which appear cheap but require tests, releases, documentation, and ongoing maintenance. The piece concludes that underestimating these hidden dependencies is a common planning mistake.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Fixing Deploy-Time 502 Errors in Cloud-Migrated Node.js Services

Teams migrating services to the cloud often see brief 502 error bursts during every deploy. The cause is usually that the service lacks proper health checks and does not shut down gracefully when it receives SIGTERM. Because the orchestrator and load balancer signal removal at different times, requests can reach a process that has already exited. Missing readiness checks and a mismatch between Node's keep-alive timeout and the load balancer's idle timeout cause further errors. Repeated failures lead teams to deploy less often and tolerate noise, which makes releases riskier. The article recommends separate liveness and readiness endpoints along with graceful draining, though serverless platforms and single-instance setups may not need this.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Rewording README and docs text so developers can follow it

Most documentation is accurate but written by authors who know the code too well to notice where newcomers get lost. Rewording should focus on the README intro, function descriptions, error messages, and jargon, since those are what readers encounter first or when something breaks. Before editing, exact identifiers like function names, flags, environment variables, and version numbers should be marked and kept unchanged so the surrounding prose can be rewritten safely. A good intro should state in two or three sentences what the project does, who it is for, and why to keep reading. Error messages should explain what went wrong and what to do next, and internal shorthand or unexplained jargon should be replaced with plain terms.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Local stdlib Python script scans for leaked secrets before git push

A developer built a Python script that detects leaked credentials in code without requiring installs, accounts, or network access. The tool, packaged as a skill for Hermes Agent, scans a folder or only staged files, flags real .env files while ignoring .env.example, and matches common token formats such as private keys, AWS and GitHub credentials, and JWTs. It skips obvious placeholder values and masks any findings so reports can be shared safely. The script exits with code 1 when secrets are found, allowing it to be used in a pre-commit hook. The author notes it is only a pattern matcher that cannot read git history or verify whether a key is still active, so exposed secrets should be rotated.

0 comments Read more at DEV Community