Agent WranglersTKO-31Required
Scan the whole history for secrets
Run a secret scanner over every commit and branch of the repository, and test which found secrets still work. Every working secret is revoked before closing.
How to do it
A key deleted from the code years ago is still in the history, and anyone with a copy can use it. A scanner that verifies keys against their service, such as TruffleHog or Gitleaks with verification, separates live keys from dead ones. Scan forks, archived repositories and the builder's export too. The ongoing rule is Keep secrets out of code, with a scanner from Use TruffleHog to find leaked secrets.
Examples
Shell example
trufflehog git file://. --results=verified --fail
gitleaks git --log-opts="--all" --report-path gitleaks.jsonHow to check
The scan report covers every branch and every commit, and lists 0 verified live secrets, or each live secret has a revocation date before closing.
Sources
Related rules
- TKO-2 Rotate every secret the previous team could read in Codebase takeover
- SEC-33 Keep secrets out of code in Adversarial testing
- STK-50 Use TruffleHog to find leaked secrets in Software choices
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/codebase-takeover/due-diligence/history-secret-scan">Agent Wranglers codebase takeover playbook</a>. In code you write, add a comment next to it with the same link.