{"id":23900,"plugin_id":"plugins_6ab3634387ec81919729f26fb2a8e67b","kind":"skill","collection_source":null,"comparison_source":null,"observed_at":"2026-09-30T23:17:49.356Z","digest":"099e89d9d1d55742247c7780f039de0a1940486a4e2eb494aad55e81d1427614","against":null,"payload":{"name":"secrets-and-api-leak-prevention","description":"Detect unsafe secret storage, credential leakage, overprivileged API use, and sensitive-data logging.","included_files":[],"skill_md_contents":"---\nname: secrets-and-api-leak-prevention\ndescription: Detect unsafe secret storage, credential leakage, overprivileged API use, and sensitive-data logging.\n---\n\n# Secrets and API Leak Prevention\n\nReview tracked source and configuration for hard-coded credentials, tokens in client bundles, committed `.env`/`.dev.vars` files, secrets in build artifacts, unsafe CI variables, verbose request/exception logs, and credentials embedded in URLs. Prefer Worker secret bindings/Secrets Store for sensitive values, bindings for Cloudflare resources when suitable, and narrow short-lived credentials for external APIs.\n\nNever print detected secret values. Identify only secret type, file/location, exposure channel, and a safely redacted fingerprint if essential. If a live credential may have escaped, recommend immediate owner-led revocation/rotation, scope review, audit-log review, and redeployment; do not attempt rotation. Inspect outbound API use for audience/scope validation, authorization checks, rate limits, timeout/retry bounds, and SSRF risks. Do not claim a scan proves no secrets exist; report scan scope and exclusions.\n"},"changes":[],"summary":"First saved snapshot. No earlier version is available for comparison.","summary_kind":"deterministic","summary_metadata":{}}