# Secrets Review Lens

Review operational infrastructure for **credential exposure and secrets hygiene**.

## What to Look For

### Hardcoded Credentials & Store Leaks
- API keys, tokens, passwords in source files
- SSH private keys (`BEGIN PRIVATE KEY`, `BEGIN RSA PRIVATE KEY`)
- **Nix**: Secrets in `.nix` strings, `writeText`, `environment.etc.*.text` (world-readable in /nix/store)
- **Docker**: Secrets in `ENV` or `ARG` instructions (persist in image layers/history)

### Secrets in Unsafe Channels
- Credentials passed as CLI arguments (visible in `ps`)
- Secrets in `export` statements in shell scripts
- Tokens in URLs, query parameters, or connection strings
- Docker `build-arg` for sensitive values

### Logging & CI Exposure
- `set -x` in scripts that handle credentials
- Secrets echoed to stdout/stderr or logs
- Missing CI secret masking (GitHub `::add-mask::`, GitLab masked vars)
- Debug flags that leak secrets (`curl -v`, `--debug`)

### SOPS & Encryption Issues
- Plaintext files that should use SOPS (secrets.yaml, credentials.json)
- Missing `.sops.yaml` when encrypted files present
- Overly broad SOPS `creation_rules` access

## Linter Integration

```bash
gitleaks detect --source . --report-format json
```

## Output Format

```
[SECRETS] <severity:HIGH|MED|LOW> <file:line>
Issue: <what credential is exposed and via what channel>
Suggest: <sops-nix, Docker BuildKit secrets, env file with 0600, etc.>
Evidence: <pattern match or context>
```

## Guidelines

- **HIGH** = credential in repo, Nix store, Docker layer, or logs
- **MED** = credential in risky channel (CLI arg, build arg, unmasked CI)
- **LOW** = missing encryption best practice
- **Keywords**: `*_KEY`, `*_TOKEN`, `*_SECRET`, `*_PASSWORD`, `*_CREDENTIAL`
- **Ignore**: Nix hashes (`sha256-`, `narHash`, `vendorHash`), public keys, checksums, UUIDs, placeholders (`REPLACE_ME`, `changeme`, `example`)
- **Nix remediation**: Use `sops-nix` or `agenix`, reference via runtime paths not embedded strings
- **Docker remediation**: Use BuildKit `--mount=type=secret`, avoid `ENV` for secrets
