{ "schema": "aiblocks-page/1", "id": "find-leaked-keys-move-them-to-safe-storage-and-check-the-live-site", "type": "workflow", "name": "Secret exposure review and storage setup", "summary": "Review project secrets and plan key rotation. Set up secret storage and check the deployed site for remaining exposure.", "headline": "Secret exposure review and storage setup", "subhead": "Share the project, live address and deployment setup without pasting secret values into the report. It reviews exposure and rotation order. You rotate the keys at their providers. It updates storage and code access, then pauses for deployment before checking the live site. You get three step files and findings. A scan covers what was inspected; it does not prove every secret is safe.", "job": { "id": "secure-code", "name": "Keep your code secure" }, "level": "intermediate", "thinking": "medium", "tested": true, "updated": "2026-10-28", "first_published": "2026-10-21", "inputs": [ { "type": "codebase", "required": true, "label": "Codebase", "what": "a project's code, in a folder or repo the AI can open" }, { "type": "deploy_url", "required": true, "label": "Deploy url", "what": "a live link to the app, and how it was put online" } ], "outputs": [ { "type": "security_report", "required": true, "label": "Security report", "what": "the risks found in the code, ranked, each with a fix" } ], "you_give": [ "Your project (a folder or repo the AI can open, with its history)", "Where you run it, such as your host, your CI and the secret store you prefer (optional)", "The address of your live site, once you have deployed" ], "you_get": [ "A list of every leaked or loose secret, ranked, with the order to replace them", "Code changed to read secrets from a store, with who may read each one", "A plan to rotate secrets again on a schedule", "A report on what the live site shows to a visitor, with a fix for each find" ], "use_when": [ "A key or password was pushed to a repo, pasted in chat or sent in a screenshot.", "Your project has env files, keys in code or secrets in CI settings with no plan.", "You want proof that your live site does not show any key to visitors." ], "skip_when": [ "You have a key you cannot replace yet: ask the provider for a limit or a lock on it first, then come back to run the scan.", "You want to test a site you do not own: only scan your own site, or one you have written permission to test.", "You only want a quick scan of one repo: turn on the secret scanning that your code host already offers." ], "output_sample": { "input": [ "Your project (a folder or repo the AI can open, with its history)", "Where you run it, such as your host, your CI and the secret store you prefer (optional)", "The address of your live site, once you have deployed" ], "prerequisites": [ "An AI that can open your project folder and its git history", "A way to replace keys at each provider and to deploy your code" ], "output": [ { "name": "Step 1: Secrets hygiene checker", "contains": "Each leaked or loose secret by name, where it was found, and the order to replace them." }, { "name": "Your step: replace the keys", "contains": "You replace each key at its provider in the given order and remove old copies from your files." }, { "name": "Step 2: Secrets setup helper", "contains": "The store chosen, the code changes to read secrets from it, who may read each one, and a rotation plan." }, { "name": "Your step: deploy", "contains": "You deploy the updated code and keep the address of your live site." }, { "name": "Step 3: Exposed secrets finder", "contains": "What a visitor can read on your live site, ranked finds, and a fix for each." }, { "name": "HAND-BACK SUMMARY", "contains": "Each step's file, any step not run and why, and every MISSING line in one list." } ] }, "output_shape": "STEP 1: LEAKED SECRETS\n Each secret by name | where it was found | rotate order\n\nYOUR STEP: replace the keys\n\nSTEP 2: SAFE STORAGE\n Store chosen | code changes | who reads what | rotation plan\n\nYOUR STEP: deploy, keep the live address\n\nSTEP 3: LIVE SITE CHECK\n What a visitor can read | ranked finds | fixes\n\nHAND-BACK SUMMARY\n Files: | MISSING: ", "how_to_use": [ "Download the handoff pack. It's a zip with HANDOFF.md plus one skill file for each step.", "Give the folder to Claude (in Claude Code, or as files in a Claude Project) and say \"Follow HANDOFF.md\".", "It never needs to print a secret. Tell it to refer to keys by name and the last four characters.", "Do not skip your two steps, which are replacing the keys and deploying." ], "checks": [ "No secret value appears in the report, only its name and where it sits.", "Every secret is either rotated or has a reason it can wait, with a date.", "The code reads each secret from the store, with no fallback value left in a file.", "The live check looked at the scripts, not only the page.", "Anything still open is on the list, not hidden." ], "steps": [ { "position": 1, "id": "secrets-hygiene-checker", "name": "Secret leak checker", "summary": "Find likely leaked credentials without copying their values into reports, then get a safe triage plan.", "url": "https://useaiblocks.com/skills/secrets-hygiene-checker" }, { "position": 2, "id": "secrets-setup-helper", "name": "Credential setup planner", "summary": "Get a secrets management plan for your CI/CD pipeline: how to store, read and rotate secrets in Vault, a cloud store or GitHub Actions.", "url": "https://useaiblocks.com/skills/secrets-setup-helper" }, { "position": 3, "id": "exposed-secrets-finder", "name": "Exposed secrets finder", "summary": "Share a site you own. Get a report of keys and private files visitors can read, with fixes.", "url": "https://useaiblocks.com/skills/exposed-secrets-finder" } ], "next": [ { "name": "AI agent attack tester", "url": "https://useaiblocks.com/skills/ai-agent-attack-tester", "why": "AI agent attack tester" }, { "name": "Prompt injection defender", "url": "https://useaiblocks.com/skills/prompt-injection-defender", "why": "Prompt injection defender" } ], "source": null, "credits": [], "files": [], "links": { "page": "https://useaiblocks.com/workflows/find-leaked-keys-move-them-to-safe-storage-and-check-the-live-site", "markdown": "https://useaiblocks.com/workflows/find-leaked-keys-move-them-to-safe-storage-and-check-the-live-site.md", "json": "https://useaiblocks.com/workflows/find-leaked-keys-move-them-to-safe-storage-and-check-the-live-site.json", "instructions": "https://useaiblocks.com/skills/find-leaked-keys-move-them-to-safe-storage-and-check-the-live-site/SKILL.md", "api_item": "https://useaiblocks.com/api/v1/items/find-leaked-keys-move-them-to-safe-storage-and-check-the-live-site", "api_document": "https://useaiblocks.com/api/v1/documents/workflow/find-leaked-keys-move-them-to-safe-storage-and-check-the-live-site", "mcp": "https://useaiblocks.com/mcp" } }