Hire an AI secret exposure review and storage setup

Everything it can hand back

Your task sets the actual outputs. The specialist picks the methods that cover them.

• A list of every leaked or loose secret, ranked, with the order to replace them
• Code changed to read secrets from a store, with who may read each one
• A plan to rotate secrets again on a schedule
• A report on what the live site shows to a visitor, with a fix for each find

How it does the job well

• Name the asset, the threat and the impact before recommending controls.
• Rank findings by real risk (likelihood and impact), with evidence for each.
• Prefer fixes that remove a problem over warnings that rely on people.
• Cite the exact law, standard or clause for compliance and legal points, and recommend qualified review.

Mistakes it avoids

• Long lists of generic issues with no evidence they apply.
• Testing or scanning systems without permission.
• Presenting a legal opinion as final.

What a good result looks like

An example, not your task: A key or password was pushed to a repo, pasted in chat or sent in a screenshot.

• Step 1: Secrets hygiene checker. Each leaked or loose secret by name, where it was found, and the order to replace them.
• Your step: replace the keys. You replace each key at its provider in the given order and remove old copies from your files.
• Step 2: Secrets setup helper. The store chosen, the code changes to read secrets from it, who may read each one, and a rotation plan.
• Your step: deploy. You deploy the updated code and keep the address of your live site.
• Step 3: Exposed secrets finder. What a visitor can read on your live site, ranked finds, and a fix for each.
• HAND-BACK SUMMARY. Each step's file, any step not run and why, and every MISSING line in one list.

How the work is checked

• Each step passed its own checks, or the run stopped at the step that failed and says why.
• The steps ran in order, and each one used the result of the one before.
• Nothing was invented to fill a gap. Every gap is a MISSING: line.
• Nothing was sent, published or paid for without a clear yes.
• States which checks passed, failed or could not run, and names missing inputs.

These checks have not been run against a model yet. Your AI uses them to check its own work.

Capabilities

• Find the leaked secrets. Scans the files and the git history, checks env files and what git ignores, lists every secret to treat as leaked and writes the order to rotate them.
• Replace the keys at each provider. This one is yours. Rotate each key in the order the report gives and remove old copies from your files.
• Move secrets to safe storage. Picks a store that fits your pipeline, changes the code to read from it, sets who and what may read each secret and plans the next rotation.
• Deploy the updated code. This one is yours. Deploy and keep the address of the live site for the last step.
• Check the live site. Fetches the page and every script, looks for keys in them, probes for config and source files visitors can open, ranks what turns up and writes the fix.

How the role works

1. Checks your task, context and available tools.
2. Picks the methods needed and prepares a work plan.
3. Carries out supported tasks, with each method's limits and review gates.
4. Checks the real deliverables and corrects supported faults.
5. Hands back files, evidence and unresolved gaps.

Your specialist's working setup

Download the base specialist without a task form or account. README.md and SETUP.md explain how to use the folder. SOUL.md defines its scope. INTAKE.md asks missing questions inside your AI. PLAYBOOK.md, SKILLS.md, BEST_PRACTICES.md, CHECKS.md and HANDOFF.md guide the work and its checked deliverables.

Complete associated skills, supporting files and licences are included. Choose only the methods needed for the actual task. Keep context, working files and accepted feedback in your AI project.

Use this specialist through MCP or the API

Call prepare_specialist with role_id find-leaked-keys-move-them-to-safe-storage-and-check-th-aec32235 only. No task is required to load it. Your AI asks what job you need done, what you want back and which relevant context it can use.

For task-led hiring, call find_specialist, explain the suggested specialists and let the user accept or change the team.

Complete ZIP: Download base specialist. API: GET /api/v1/specialists/find-leaked-keys-move-them-to-safe-storage-and-check-th-aec32235/pack. The host AI supplies its own model, tools and execution; a pack does not connect accounts or run a task.

Inputs and helpful context

The specialist starts from the task brief. Only active methods require their inputs.

For the primary method, when used

• Your project (a folder or repo the AI can open, with its history)
• Where you run it, such as your host, your CI and the secret store you prefer (optional)
• The address of your live site, once you have deployed

Functions and deliverables

• Secret exposure review and storage setup: Review project secrets and plan key rotation. Set up secret storage and check the deployed site for remaining exposure.
  • A list of every leaked or loose secret, ranked, with the order to replace them
  • Code changed to read secrets from a store, with who may read each one
  • A plan to rotate secrets again on a schedule
  • A report on what the live site shows to a visitor, with a fix for each find
• Secret leak checker: Find likely leaked credentials without copying their values into reports, then get a safe triage plan.
  • A list of likely leaked secrets ranked by severity
  • Rotation and cleanup steps
  • A tidied env file layout
  • A pre-merge secret scan setup
  Source: Alireza Rezvani.
• Credential setup planner: Get a secrets management plan for your CI/CD pipeline: how to store, read and rotate secrets in Vault, a cloud store or GitHub Actions.
  • A retrieval and access design
  • A rotation sequence with rollback
  • Log and artifact leak checks
  • A test list for denied and failed cases
  Source: sickn33.
• Exposed secrets finder: Share a site you own. Get a report of keys and private files visitors can read, with fixes.
  • List of exposed secrets and files
  • Where each one was found
  • Risk level per finding
  • Fix steps, including rotating keys
  Source: sickn33.
• me.md builder: Answer a few questions, or let your AI use what it remembers. Get one private file that tells any AI who you are.
  • One me.md file with up to ten dated sections
  • A list of facts taken from memory, for you to check
  • A short note of what it removed for privacy
  • The two next steps, to save it and set it up

Tasks you can use it for

• A key or password was pushed to a repo, pasted in chat or sent in a screenshot.
• Your project has env files, keys in code or secrets in CI settings with no plan.
• You want proof that your live site does not show any key to visitors.

Limits to check before starting

• You have a key you cannot replace yet: ask the provider for a limit or a lock on it first, then come back to run the scan.
• You want to test a site you do not own: only scan your own site, or one you have written permission to test.
• You only want a quick scan of one repo: turn on the secret scanning that your code host already offers.

Best way to use this role

Give it one clear outcome, the actual files and a definition of done. Keep the work in one AI project so it can reuse checked context and earlier files.

• Download the handoff pack. It's a zip with HANDOFF.md plus one skill file for each step.
• Give the folder to Claude (in Claude Code, or as files in a Claude Project) and say "Follow HANDOFF.md".
• It never needs to print a secret. Tell it to refer to keys by name and the last four characters.
• Do not skip your two steps, which are replacing the keys and deploying.

Read it as data

Read the complete role setup as JSON. Connect your AI to the AI Blocks MCP library and read aiblocks://roles/find-leaked-keys-move-them-to-safe-storage-and-check-th-aec32235 for its role instructions and pinned sources.

This is a prepared AI role. No task has run. Your AI carries out authorized work using its available tools and reports the actual deliverables and checks.