I Scanned Every Repo I've Ever Written. The Results Were Uncomfortable.

The recursive scan of the user's entire project directory, conducted on a Sunday, revealed uncomfortable findings. The tool, named dotguard, scanned .env files, configuration files, and source code for exposed secrets. Despite its generous estimate, the findings exceeded expectations. The most concerning aspect was the age of the oldest finding, which dated back to the first commit of the user's first public repository.

The scan was unable to reach this repository, as it only examines the past, while the rotation process closes the present. The results were detailed, categorized by age, type, live status, and dead status. The findings prompted two habits: a quarterly sweep and a history audit. The tool, dotguard, facilitates the scanning of secrets, with zero dependencies and JSON reports.

The installation command is simple: npx @wuchunjie/dotguard. The verification process involves open the file, looking at the line, and answering if the value is live or a fixture. The former requires rotation and re-scan, while the latter calls for noting and moving forward. The verification process takes five seconds, making it an effective habit.

False positives are the real cost of a scanner, so the scanner leans towards flagging to minimize errors. Integration of the scanner into GitHub Actions is achieved through a one-line command, ensuring the build fails if a secret is found. The JSON report generated by the scanner is machine-readable and easily integrated into CI pipelines.