Agent WranglersAPS-60Required
Keep secrets out of code
Never write a password, key or token into code, settings files in the repo, or its history.
How to do it
Read secrets from environment variables or a secret store at start-up. Add a secret scanner to the pre-commit hook and the build, as Use TruffleHog to find leaked secrets says. A secret that ever reached the repo is leaked, so replace it, even after you delete the commit.
Examples
Shell example
# gitleaks 8.19 or later scans every commit on every branch
gitleaks git --redact --log-opts="--all" .How to check
The agent runs a secret scanner over the whole history, not only the latest commit. It finds no live key.
Sources
Related rules
- AID-15 Read every line of the diff in AI-assisted development
- ENG-66 Send only the files the build needs in Engineering
- ENG-58 Block pushes that contain secrets in Engineering
- ENG-22 Keep settings outside the code in Engineering
- ENG-26 Keep secrets in a secrets store in Engineering
- API-80 Give each environment its own provider key in API design
- INF-2 Keep state remote with locking and encryption in Infrastructure and environments
- INF-26 Give services the identity of their machine in Infrastructure and environments
- STK-50 Use TruffleHog to find leaked secrets in Software choices
- DOC-13 Generate the settings reference from one schema in Documentation
- DOC-23 Use only made-up data in docs in Documentation
- SUP-6 Mask card numbers and secrets that arrive in tickets in Customer support
- IOT-3 Ship no shared secret in the firmware image in Connected devices
- OSS-20 Publish only the files from the tagged source in Open source maintenance
- OSS-41 Deleting a published version that others depend on in Open source maintenance
- TDD-7 Scan the whole history for secrets in Technical due diligence
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/secrets-and-configuration/secrets-out-of-code">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.