GitHub Repository Secrets Scanning and Prevention Review (Defensive)
Check protections against committing credentials.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it.
Review secret protection as a defensive review. Repositories and visibility, scanning tools enabled, pre-commit checks, how secrets are stored for builds, and past incidents (types only): [SECRET_PRACTICES]. Present a table with Control, Present, Evidence, Gap and Priority covering scanning on push [VERIFY], protection for public repositories, pre-commit hooks, ignore rules and a policy for environment files, separate configuration for development and production, a secrets manager, short-lived credentials, a rotation schedule, access to build secrets, and developer training. Add a severity guide: a credential found in a private repository still needs rotation if anyone left or forks exist; one found in a public repository must be treated as compromised at once. Provide a 30-day plan with owners, a checklist of what to do on detection, and metrics such as time from detection to rotation. Recommend practical controls that developers will follow. Never ask me to paste real secrets. Mark any setting or syntax that depends on version [VERIFY] so I test it on a small sample first.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.