---
name: audit-secrets
description: Use when checking a project directory for leaked credentials, API keys, tokens, or hardcoded secrets before deploying to Vercel or sharing the codebase. Works with or without git.
metadata:
  category: Security & Maintenance
---

# Skill: audit-secrets

## Overview

Dispatch the `secret-scanner` agent over a project directory, then map each finding to a concrete fix action. No git required — works on any local directory.

## Steps

### 1. Identify project path

If the user hasn't provided a path, ask: "What is the path to the project you want to scan?"

### 2. Dispatch scan agent

```
Agent({
  subagent_type: "humand-frontend-sandbox:secret-scanner",
  prompt: "Scan the project at {projectPath}"
})
```

### 3. Apply remediation framework

Present the findings, then map each finding type to the appropriate action:

| Finding type | Immediate action | Long-term fix |
|---|---|---|
| Key hardcoded in `src/` | Rotate credential immediately | Move to `.env`, read via `import.meta.env` |
| Key in `vite.config.ts` `define` block | Rotate immediately | Remove `define` block — use backend/edge function |
| `SERVICE_ROLE_KEY` anywhere in frontend | Rotate + remove from frontend entirely | Service-role keys belong only in server-side environments |
| Any secret in `public/` | Rotate + delete the file | Never put credentials in `public/` — world-readable |
| Token in `.npmrc` | Rotate (npm + GitHub) | Add `.npmrc` to `.gitignore`, inject via CI env vars |
| Key in `.env` (possibly committed) | Check git history, rotate if ever committed | Add `.env` to `.gitignore`, create `.env.example` |

### 4. Vercel-specific guidance

Always add:

> **Vercel:** Set secrets in the Vercel dashboard → Settings → Environment Variables. Vercel injects them at build time — they never live in source files.

If the project has git, also suggest:
```bash
git log --all -- .env .npmrc
```
If either file appears in history, deleting it is not enough — rewrite history with `git filter-repo` or BFG, then rotate every affected credential.

## Key Supabase distinction

| Variable | Risk | Verdict |
|---|---|---|
| `VITE_SUPABASE_ANON_KEY` | Public by design — used on the client | OK in `.env` with `VITE_` prefix |
| `SUPABASE_SERVICE_ROLE_KEY` | Bypasses RLS, full admin access | **Never in frontend** — rotate immediately |
