# Secret Scan Triage

> Triages GitHub secret-scanning alerts by blast radius into a rotate-first runbook. Never closes an alert, never prints the secret.

- Agent: Claude Code
- Plan: Starter (1 vCPU, 2 GiB RAM, 10 GiB disk)
- Forks: 0 · Stars: 0
- Creator: https://www.jurniti.com/creator-ca0ff2
- Tags: claude-code, devops, github, secrets, security, software-factory
- Requires config (you provide): ANTHROPIC_API_KEY
- Skills: secret-scan-triage

**To fork:** open https://www.jurniti.com/templates/secret-scan-triage and use the Fork action — it starts a Stripe Checkout for a new VM seeded with this template's persist disk (same flat plan price, no fork fee).

## README

# Rewriting git history first is exactly backwards

Forty secret-scanning alerts. Most are example values in docs, a few are real.
The instinct is to force-push the history so the alerts go away.

Now the alert is gone, the credential is still live, and nobody is looking for it.

**The order is rotate → revoke → clean history.** History cleaning is last, and
it's optional.

## A secret in git history is compromised. Full stop.

The rules file forbids reasoning about whether the repo was private, whether the
commit got force-pushed away, or whether anyone "probably" saw it. Private repos
get cloned, forks persist, CI logs leak.

The only question worth answering is **blast radius** — not whether to act.

## Classified by what the credential can do

- **P0 — live + privileged.** Cloud keys, DB URLs with credentials, live payment
  keys, signing keys, admin tokens. Rotate now, page someone.
- **P1 — live + scoped.** Third-party keys with limited scope. Rotate today.
- **P2 — test/sandbox.** Confirmed test-mode credential. Rotate at leisure, fix
  the pattern that let it in.
- **FALSE POSITIVE** — with *why* it's false, plus a proposed scanner exclusion so
  it stops recurring.

A classification that doesn't name the capability isn't a classification.

## What the runbook gives you

Per credential: the provider, the rotation steps, **what breaks when the old key
dies**, and who to tell.

Inside each bucket, ordered by blast-on-rotation *ascending* — so you can start
with the ones that are safe to rotate immediately while you plan the risky ones.

Plus a **Prevention** section naming the single config change that would have
stopped the most alerts in this batch.

## It never prints the secret

Not even partially masked. Reports reference alert id, file, line and credential
*type* only — because a triage report is an artifact that gets pasted into chat.

## What you supply

`gh auth login` with a token carrying `security_events` read, plus your own
Claude Code login. `gh` ships at `~/.local/bin/gh`.

## Where this stops

It triages and drafts. It does not dismiss or close alerts, rotate credentials,
or rewrite history.

It won't claim a secret was never used — it can't see the provider's access logs
— won't confirm a rotation is complete, and won't tell you history rewriting
removed anything, because forks and caches persist.

Verified on build: the skill, the working tree, both guards, the never-print rule
and a working `gh` are present on a fresh fork. Running it on your own repo is
yours to do.