0Pricing
Cyber Security Academy · Lesson

Secrets Scanning and Hardcoded Credentials

Prevent API keys and passwords from being committed using git-secrets, gitleaks, and pre-commit hooks.

Secrets Scanning and Hardcoded Credentials is a free Cyber Security Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

The Hardcoded Secrets Problem

Developers accidentally commit API keys, passwords, private keys, and tokens to source code repositories. Once in git history, they persist even after deletion. Public repositories are scraped by bots within seconds of a push.

What Gets Committed

Common secrets found in repositories:

  • AWS access keys (AKIA...)
  • GitHub personal access tokens
  • Database passwords in config files
  • Stripe/payment API keys
  • Private TLS/SSH keys
  • Slack webhook URLs

Pre-commit Hooks for Prevention

Prevent secrets from reaching git in the first place:

# Install gitleaks as a pre-commit hook:
pip install pre-commit
# .pre-commit-config.yaml:
repos:
- repo: https://github.com/zricethezav/gitleaks
  rev: v8.18.1
  hooks:
  - id: gitleaks

Scanning Existing Repositories

Scan existing repos for secrets:

# gitleaks: scan entire git history
gitleaks detect --source . --log-opts="--all"

# truffleHog: high-entropy string + regex detection
trufflehog git file://.

# GitHub secret scanning (automatic for public repos)
# Alerts under Security → Secret scanning alerts

GitHub Secret Scanning

GitHub automatically scans public repositories for known secret patterns (AWS keys, GitHub tokens, etc.) and notifies the provider. For private repos, GitHub Advanced Security extends this capability. Providers like AWS revoke keys automatically on detection.

The .gitignore Solution (and Its Limits)

Adding .env to .gitignore prevents accidental commits. But developers still commit secrets in other files, and .gitignore doesn't help if the file was already committed. Defense-in-depth: gitignore + pre-commit hooks + CI scanning.

Using Environment Variables

Secrets should never appear in code. Use environment variables loaded at runtime:

# Python:
import os
api_key = os.environ["API_KEY"]

# Node.js with dotenv (for local dev only):
require("dotenv").config()
const apiKey = process.env.API_KEY

# Never commit .env to git

Secrets Managers

Production applications should use dedicated secrets managers:

  • AWS Secrets Manager — automatic rotation, IAM-controlled access
  • HashiCorp Vault — open source, enterprise, many backends
  • Azure Key Vault / GCP Secret Manager

Secrets are never in code or environment variables on disk.

Rotating Compromised Secrets

If a secret is exposed:

  1. Revoke the secret immediately (before investigating)
  2. Check access logs for unauthorized use
  3. Generate a new secret
  4. Update all systems using the old secret
  5. Remove from git history with git-filter-repo or BFG Repo Cleaner

Removing Secrets from Git History

After revoking, remove from history:

# BFG Repo Cleaner (faster than filter-branch):
java -jar bfg.jar --delete-files .env repo.git
git reflog expire --expire=now --all
git gc --prune=now --aggressive
git push --force
# Note: force push rewrites history - coordinate with team

Secrets in CI/CD Pipelines

CI/CD systems have their own secrets management:

  • GitHub Actions: Secrets stored in repository/org settings → accessed as ${{ secrets.API_KEY }}
  • GitLab CI: CI/CD Variables
  • Jenkins: Credentials plugin

Mask secrets in logs. Never print them in debug output.

Quick Check: Secrets Scanning

What is the most effective first line of defense to prevent secrets from entering a repository?

Lesson Recap

Hardcoded secrets in git are a critical risk — public repos are scraped by bots within seconds. Prevention: pre-commit hooks (gitleaks), gitignore. Detection: truffleHog, GitHub secret scanning. Store secrets in environment variables or dedicated secrets managers (Vault, AWS Secrets Manager). Rotate immediately when exposed; remove from git history with BFG Repo Cleaner.

Frequently asked questions

Is the “Secrets Scanning and Hardcoded Credentials” lesson free?

Yes — the full text of “Secrets Scanning and Hardcoded Credentials” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Secrets Scanning and Hardcoded Credentials”?

Prevent API keys and passwords from being committed using git-secrets, gitleaks, and pre-commit hooks. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Secrets Scanning and Hardcoded Credentials” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. SAST and DAST in CI/CD Pipelines
  2. Software Composition Analysis (SCA)
  3. Secrets Scanning and Hardcoded Credentials
  4. Security Champions and Threat Modeling
← Back to Cyber Security Academy