secret-scan

Scan the working tree or git diff for hardcoded secrets — API keys, tokens, private keys, connection strings, cloud credentials — across common providers. Reports file:line with the masked match. Pure Claude Code, no signup.