Security Secrets & Dependency Audit — Leak Risk, Attack Path

Name: Security Secrets & Dependency Audit — Leak Risk, Attack Path
Price: 15 USD
Availability: InStock
Author: Agensi

The problem Scanner dumps list “possible secrets” without saying what the business loses or what an attacker would do next.

$15

30-day refund guarantee

Secure checkout via Stripe

0 installsSecurity scanned

See it in action

You say

Mode: Gate (publish Apache-2.0 next week) Repo: glacier-archive-worker — Go media archive indexer (university)

Surfaces:

docker-compose.override.yml with R2-style access key pair + prod bucket name (~5 months in git)
helm/glacier/values-prod.yaml with smtps://apikey:SG.…@smtp… embedded
worker.example.toml YOUR_R2_ACCESS_KEY_HERE (placeholder)
docs/setup.md glpat-ExamplePlaceholderToken0000 (placeholder)
go.mod: gopkg.in/yaml.v2 v2.2.8, golang.org/x/net v0.7.0

Ask: go/no-go for open-source; mask all secrets; do not modify the repo.

Your agent does

Security Secrets & Dependency Audit

1. Assessment Summary

| Field | Value | |---|---| | Repo | glacier-archive-worker | | Mode | Gate (pre-open-source) | | Threat model | Object-store + SMTP + researcher emails — high if keys real | | Secrets | 4 (2 critical patterns / 2 placeholders) | | Dependencies | 2 (verify via govulncheck) | | Maturity | CRITICAL-EXPOSURE | | Open-source gate | NO-GO |

2–3. Threat model & surfaces

Research media store + institutional email identity. Compose, Helm, docs, go.mod scanned. Placeholders filtered; compose + Helm fail Gate.

4. Secrets (masked only)

| ID | Where | Masked | Class | Severity | |---|---|---|---|---| | SEC-01 | docker-compose.override.yml | AKIA**** / wJal**** | needs-review → treat compromised | CRI | SEC-02 | helm values-prod | SG.**** in SMTP URL | real-pattern | CRITICAL | | SEC-03 | example.toml | YOUR_R2_**** | placeholder | INFO | | SEC-04 | docs/setup.md | glpat-**** | placeholder | INFO |

Lifecycle: SEC-01 ~5 months in remote history — rotation required even if file is deleted.

5. Dependencies

DEP-01 yaml.v2@v2.2.8 — outdated; verify advisories / upgrade DEP-02 x/net@v0.7.0 — outdated; govulncheck before release (No invented CVE IDs.)

6–7. Attack paths & business impact

Open-source × SEC-01 → keys tried against research bucket
SEC-02 → send-as phishing
SEC-01 + reachable parser issue (if confirmed) → chained host impact Priority: SEC-01, SEC-02, then deps.

8–9. First hour + roadmap

Rotate object-store + SMTP keys now → audit provider logs → assume history leaked → externalize Helm secrets → govulncheck upgrades → pre-commit/CI gates → re-run Gate.

10–13. Prevention, confidence, maturity

Layers: pre-commit → CI → secrets manager → no tracked overrides → Renovate/govulncheck. Verdict CRITICAL-EXPOSURE until critical secrets gone; then HIGH-RISK → MODERATE → CLEAN path. Static only — not a pen test.

14. JSON

Full Audit JSON with masked_value fields, attack_paths, remediation_roadmap, assumptions.

What you get

Full secrets + dependency audit of a service repoFirst-hour response after a suspected key leakPre-open-source / pre-contractor Gate go/no-goCompare security debt against a prior baselinePrioritize findings by business impact and attack pathsDesign layered prevention (pre-commit, CI, secrets manager)

About this skill

The problem

Scanner dumps list “possible secrets” without saying what the business loses or what an attacker would do next.
Credentials in Docker Compose overrides, Helm values, and CI history survive long after a file is “fixed.”
Dependency noise (dev-only, unreachable) drowns out reachable, high-impact issues.
Teams open-source or share repos without a clear go/no-go gate.

What it does

Scopes a threat model (what the system protects and why findings matter).
Scans major leak surfaces: source, config, .env, IaC, CI/CD, Docker, Helm/k8s, docs, fixtures.
Classifies secrets as real / placeholder / needs-review and masks values (e.g. AKIA****MPLE).
Adds secret lifecycle: age, git history, remote exposure, environment.
Weights dependencies by severity, reachability, exploitability, maintainer health, and license.
Builds attack paths and a business-impact order.
Delivers first-hour response, remediation roadmap, prevention layers, and a maturity verdict with a path up.

Frameworks & tools

Works across Node, Python, Go, containers, Helm, and common package manifests (package.json, go.mod, requirements.txt, etc.).
Modes: Audit, Incident, Gate (pre-release/open-source), Compare (baseline).
Compatible with Claude Code, Cursor, Codex CLI, OpenClaw — file-read only for the assessment itself.

Why this beats prompting it yourself

False-positive discipline so YOUR_KEY_HERE does not page the same as a live key.
Lifecycle thinking: history and remotes matter more than “file deleted.”
Attack paths, not flat lists.
Explicit open-source / release Gate verdict.
Safety-by-design: no full secret dump in the report.
Honest coverage map when advisories were not machine-verified.