About this template
Rewriting git history first is exactly backwards
Forty secret-scanning alerts. Most are example values in docs, a few are real. The instinct is to force-push the history so the alerts go away.
Now the alert is gone, the credential is still live, and nobody is looking for it.
The order is rotate → revoke → clean history. History cleaning is last, and it's optional.
A secret in git history is compromised. Full stop.
The rules file forbids reasoning about whether the repo was private, whether the commit got force-pushed away, or whether anyone "probably" saw it. Private repos get cloned, forks persist, CI logs leak.
The only question worth answering is blast radius — not whether to act.
Classified by what the credential can do
- P0 — live + privileged. Cloud keys, DB URLs with credentials, live payment keys, signing keys, admin tokens. Rotate now, page someone.
- P1 — live + scoped. Third-party keys with limited scope. Rotate today.
- P2 — test/sandbox. Confirmed test-mode credential. Rotate at leisure, fix the pattern that let it in.
- FALSE POSITIVE — with why it's false, plus a proposed scanner exclusion so it stops recurring.
A classification that doesn't name the capability isn't a classification.
What the runbook gives you
Per credential: the provider, the rotation steps, what breaks when the old key dies, and who to tell.
Inside each bucket, ordered by blast-on-rotation ascending — so you can start with the ones that are safe to rotate immediately while you plan the risky ones.
Plus a Prevention section naming the single config change that would have stopped the most alerts in this batch.
It never prints the secret
Not even partially masked. Reports reference alert id, file, line and credential type only — because a triage report is an artifact that gets pasted into chat.
What you supply
gh auth login with a token carrying security_events read, plus your own
Claude Code login. gh ships at ~/.local/bin/gh.
Where this stops
It triages and drafts. It does not dismiss or close alerts, rotate credentials, or rewrite history.
It won't claim a secret was never used — it can't see the provider's access logs — won't confirm a rotation is complete, and won't tell you history rewriting removed anything, because forks and caches persist.
Verified on build: the skill, the working tree, both guards, the never-print rule
and a working gh are present on a fresh fork. Running it on your own repo is
yours to do.