Agent Wranglers

Data and secrets Required

Keep secrets out of code

Never write a password, key or token into code, settings files in the repo, or its history.

By Erik Bergstedt, Agent Wranglers. Updated .

How to do it

Read secrets from environment variables or a secret store at start-up. Add a secret scanner, such as gitleaks, to the pre-commit hook and the build. A secret that ever reached the repo is leaked, so replace it, even after you delete the commit.

Example

gitleaks detect --source . --log-opts="--all"

How to check

The agent runs a secret scanner over the whole history, not only the latest commit. It finds no live key.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/secrets-out-of-code.