Secrets and Configuration Leak Check
Look for exposed secrets and risky configuration.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
Review my repository and configuration for exposed secrets and risky settings. Stack and hosting: [STACK_AND_HOSTING]. Repository structure (file names only): [FILE_TREE]. Configuration files and CI pipeline files (with real secret values removed and replaced by placeholders): [PASTE_CONFIG_FILES]. Work through this checklist, marking each item Found, Not found, or Cannot tell from what you gave me, with the file and line reference when found: [ ] API keys, tokens, passwords, or private keys in source or config [ ] Secrets in example files, tests, or comments [ ] .env files or credential files committed or not ignored [ ] Secrets printed in logs or error messages [ ] Overly permissive CORS, debug mode on, verbose errors in production [ ] Default credentials or open admin routes [ ] CI/CD variables exposed to untrusted branches [ ] Cloud storage or database access set to public [ ] Secrets in container images or build arguments [ ] Long-lived credentials where short-lived ones could be used For every Found item, state severity, the exact fix, and the rotation steps. Always state that any exposed secret should be treated as compromised and revoked, even after deleting it from history. Add a git history scan procedure using a standard secret scanner, and a pre-commit hook recommendation.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.
See an example result (fictional data)
[x] FOUND config/settings.py line 12: database password in source. Severity: critical. Fix: move to an environment variable, rotate the password now (treat it as exposed even after deleting). [x] FOUND .env committed in commit a41f2 (history). Fix: remove, rotate keys, add .env to .gitignore, scan history with a secret scanner. [ ] Not found: keys in tests. [x] FOUND DEBUG = True in production settings. Fix: set False, show generic error pages. [?] Cannot tell: CI variables exposure; need the pipeline file for pull-request builds. Priority: rotate the DB password and API key first, then clean history, then pre-commit hook.
Illustrative only, made-up data. Your results will differ and must be reviewed.