{
  "markdown": "# 🔒 SecretKeeper\n\n> **Because your AI agent is a generous philanthropist trying to donate your AWS budget and Stripe keys to the public domain.**\n\nAI agents are brilliant, fast, and write code at 1000 WPM. They are also completely oblivious to security. If left unsupervised, they *will* hardcode your production database URL, log your JWT signing key to the console, and push it to main at 3:00 AM. \n\n**SecretKeeper** is the paranoid, caffeine-fueled security engineer that sits in your agent's context and blocks them from shipping credentials before you get paged.\n\n---\n\n## 🧐 The Problem\n\nLLMs love credentials. To an LLM, `\"AKIAIOSFODNN7EXAMPLE\"` is just a string that completes a code snippet beautifully. They don't pay the cloud bills, and they don't have to explain the data breach to the board of directors. \n\nIf you use Cursor, Claude Code, Cline, or Copilot, you are one tab-complete away from a public disclosure. \n\n---\n\n## 🛡️ The Two Layers of Paranoia\n\nSecretKeeper does not trust the LLM. It does not trust you. It barely trusts itself.\n\n1. **Prompt Injections (The Agent Brainwashing):** Injected system instructions (`AGENTS.md`, `.cursorrules`, etc.) that train the agent to be pathologically terrified of hardcoded credentials. It forces the agent to use `process.env` and update `.env.example` automatically.\n2. **Deterministic Scan (The Safety Net):** A zero-dependency, lightning-fast regex + Shannon entropy scanner that runs in pre-commit hooks and agent post-write hooks. Even if the LLM \"hallucinates\" that it's safe to write a secret, the scanner catches it on disk and intercepts the agent's flow.\n\n---\n\n## 🧗 The Ladder of Paranoia\n\nWhen writing code, SecretKeeper forces your agent to follow the ladder:\n\n1. **Deny existence:** Does the code *actually* need an API key to run a local test? No? Don't write it.\n2. **Hide in Environment:** Use `process.env.STRIPE_SECRET_KEY` / `os.environ.get()` / equivalent.\n3. **Document the placeholder:** Immediately add `STRIPE_SECRET_KEY=your_stripe_key_here` to `.env.example`.\n4. **Silence the logs:** Never `console.log(apiKey)` or `print(password)`. If you log it, it leaks in browser DevTools.\n5. **Complain:** If forced to write a literal secret, the agent will throw a warning, complain, and ask for parameterized configurations.\n\n---\n\n## ⚡ Quick Start\n\n### Installation\n\n#### Option A: Install Globally as a CLI Tool\n```bash\n# Install directly from GitHub\nnpm install -g https://github.com/Puja-Jorwar/secretkeeper.git\n\n# Or if you are developing locally, run this in the repo root:\nnpm link\n```\n\n#### Option B: Install as a local Project Dependency\n```bash\nnpm install --save-dev secretkeeper\n```\n\n---\n\n## 🛠️ CLI Usage\n\nIf installed globally, you can run the `secretkeeper` command directly. If installed locally, prefix commands with `npx`.\n\n| Command | Action |\n|---------|--------|\n| `secretkeeper scan` | Scan current git diff (staged + unstaged changes) |\n| `secretkeeper scan --fix` | Scan git diff and automatically parameterize new secrets |\n| `secretkeeper audit` | Audit the entire repository for secrets |\n| `secretkeeper audit --fix` | Audit the entire repository and auto-fix/parameterize secrets in-place |\n| `secretkeeper history` | Scan git commit history for buried secrets (finds deleted keys) |\n\n---\n\n## ⚓ Git Pre-Commit Hook Integration\n\nPrevent secrets from ever leaving your computer by running SecretKeeper on every commit using **Husky**:\n\n1. Install Husky in your project:\n   ```bash\n   npm install husky --save-dev\n   npx husky install\n   ```\n2. Add a pre-commit hook that runs SecretKeeper scan:\n   ```bash\n   npx husky add .husky/pre-commit \"npx secretkeeper scan\"\n   ```\nIf SecretKeeper detects any hardcoded keys, it will block the commit.\n\n---\n\n## 🎚️ Intensity Levels\n\nTell your agent how paranoid you want to be:\n\n*   **/secretkeeper lite:** \"Write the code, but if you hardcode a key, write a comment warning me.\" (Casual mode)\n*   **/secretkeeper full:** \"Auto-replace literal secrets with `process.env` and update `.env.example`.\" (Default)\n*   **/secretkeeper ultra:** \"Refuse to write. Block execution. Warn me about suspicious high-entropy strings.\" (Paranoid mode)\n\n---\n\n## 🧪 Installation per Agent\n\n*   **Claude Code:** Copy this repo and point Claude Code at `.claude-plugin/`, or use `/plugin install`.\n*   **Cursor:** Copy `.cursor/rules/secretkeeper.mdc` into your project's `.cursor/rules/`.\n*   **Cline / Windsurf:** Copy `.clinerules/secretkeeper.md` or `.windsurf/rules/secretkeeper.md`.\n*   **Universal:** Drop `AGENTS.md` in your root folder. Any reading agent will instantly inherit the paranoia.\n\n---\n\n## 🚫 False Positives\n\nIf your test suite relies on mock credentials (like `sk_test_123`), add them to `.secretkeeperignore` so SecretKeeper doesn't wake you up at night.\n\n```\n# .secretkeeperignore\ntests/fixtures/\nbenchmarks/fixtures/\n```\n\n---\n\n## 📜 License\n\nMIT. Go ahead, fork it, run it, and stop donating your API budgets to bots scanning GitHub commits.\n",
  "bytes": 4998,
  "sha": "7aa517262e2c838561099f543bc7f7e20290ce240480cef6636547c7ade9b1e0",
  "repo_slug": "puja-jorwar/secretkeeper",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_puja_jorwar_secretkeeper_09fefffd/readme"
}