Real rules, not vague advice — what to check for API keys, tokens, and passwords, and how to catch a leak before it ever ships.
Every secret belongs in an environment variable, documented in .env.example with a placeholder, never a real value. This should be stated explicitly in CLAUDE.md, not assumed — see the e-commerce CLAUDE.md template for a real example of this convention written out.
A secret removed in a later commit is often still recoverable from git history unless it's actually purged — a quick search of the current codebase isn't enough to confirm nothing ever leaked.
.env in .gitignore is necessary but not sufficient — check whether an earlier commit already included it before .gitignore was added, and confirm .env.example never has real values swapped in "just for now."
A one-time check isn't enough on an active project — make it a routine part of shipping, not a one-off audit. See the full security checklist for the broader pre-deploy pass this fits into.
The free guide covers the permission model — the foundation these conventions build on.
Get the Free Guide →It shouldn't if the project follows real environment-variable conventions, but it depends entirely on those conventions actually being in place and documented — not on the tool guessing what's sensitive.
Search the full commit history, not just the current file state — a secret removed in a later commit is still recoverable from history unless it's actually purged.
It's necessary but not sufficient — also check that no earlier commit already included it before .gitignore was added, and that .env.example never has real values instead of placeholders.