Detectar secretos localmente y usar IA sin compartir las claves

Empieza aquí: para qué sirve esta guía

Una clave API entra por error al repositorio; enviarla a IA puede extender la filtración. Escanea localmente, conserva informes privados y comparte solo metadatos controlados. El marcador es ficticio. Obtendrás hallazgo, registro opaco y plan. Borrar la línea no revoca una clave expuesta: rótala o revócala e investiga uso. El validador no detecta todos los secretos ni sanea cualquier informe.

Un ejemplo concreto

La respuesta ilustra el formato esperado, no una auditoría de tu aplicación. Sigue los pasos y compara archivos, tests y salidas reales con el objetivo. Si el asistente solo dice que terminó, pide el entregable, las pruebas y lo pendiente.

Finding ID: finding-001; artifact: file-001; line: 1.
Status: needs-verification; owner: backend.
Action: investigate locally; rotate any genuinely exposed credential.
Do not include the credential value or raw scanner context in this response.

El objetivo

El escáner detecta candidatos; la IA ayuda a organizar un plan revisado. El laboratorio contiene un marcador deliberadamente falso y cinco tests del manifiesto de transferencia. No necesita credenciales reales.

1. Definir el alcance

Extrae el ZIP en una carpeta nueva. Node.js 22 o posterior ejecuta el validador sin red. El escaneo opcional requiere Gitleaks instalado desde su fuente oficial; se comprobó el ejercicio con 8.30.1. No escanees carpetas ajenas.

2. Ejecutar el laboratorio local

Ejecuta los tests y revisa findings.redacted.json. Solo admite identificadores opacos, un número de línea y etiquetas controladas. Rechaza campos Secret, metadatos anidados y texto libre. Conserva en privado la relación entre file-001 y el archivo real.

node --test lab.test.mjs
node lab.mjs findings.redacted.json

3. Pedir pruebas a la IA

El primer prompt utiliza únicamente el manifiesto revisado. El esquema limita lo compartido, pero no garantiza que cualquier informe esté limpio. Revisa los datos antes de enviarlos a un asistente externo.

Act as an incident triage assistant. Use ONLY findings.redacted.json from this
training kit after its local validator passes. It contains opaque artifact IDs and
controlled categories, not actual secrets or file contents. Group findings by owner,
list verification questions and draft a remediation checklist. Keep hypotheses
separate from verified exposure. Never ask for a credential, raw scanner report or
private file. For a real exposure, plan revocation or rotation at the issuing
service before considering repository-history cleanup. Do not call a provider,
rotate a key, delete evidence or rewrite Git history.

4. Verificar la corrección

El segundo prompt prepara la respuesta. Revoca o rota un secreto real expuesto con su servicio emisor. Eliminarlo del último commit o añadir .gitignore no lo revoca. Coordina por separado cualquier reescritura del historial.

Review my proposed secret-remediation plan using opaque finding IDs only. For each
verified exposure, identify the issuing service, dependent applications, replacement
rollout, revocation check and access-log review. Keep any history rewrite as a
separately approved, coordinated action. Check prevention with a secret manager,
scoped credentials and pre-commit or push protection where available. Report what is
still unverified. Do not include secret values or automatically change any
credential.

5. Aplicarlo a tu proyecto

Opcionalmente ejecuta Gitleaks en este kit. La regla detecta el marcador falso de example.fake.env; un hallazgo suele producir código 1. Conserva el informe local incluso con --redact. En un repositorio real, git examina el historial y dir los archivos actuales. El validador no detecta secretos.

gitleaks dir --config .gitleaks.toml --redact --report-format json --report-path ../gitleaks-demo.json .

Referencias oficiales

• Gitleaks · Official CLI documentation
• GitHub · Removing sensitive repository data

Read this tutorial as reference material:
https://nethanelfitoussi.com/article/ai-secrets-gitleaks-workflow?lang=en

Goal: apply the documented workflow to my development project.
Read the existing project instructions, inspect the relevant files and explain the smallest useful setup.

Available starter files:
https://nethanelfitoussi.com/api/media/b2775ae9-4193-4493-bab9-3cdc0364381b.zip
Download and inspect these files in a temporary folder before using them. Do not overwrite existing project instructions.

If I have not supplied a project folder, ask which development project to use. Do not invent a repository URL.

Additional project setup instructions:
Use the downloaded starter lab in a NEW folder. Read README.md and both English prompts first. Run its dependency-free Node.js tests before editing.

Act as an incident triage assistant. Use ONLY findings.redacted.json from this
training kit after its local validator passes. It contains opaque artifact IDs and
controlled categories, not actual secrets or file contents. Group findings by owner,
list verification questions and draft a remediation checklist. Keep hypotheses
separate from verified exposure. Never ask for a credential, raw scanner report or
private file. For a real exposure, plan revocation or rotation at the issuing
service before considering repository-history cleanup. Do not call a provider,
rotate a key, delete evidence or rewrite Git history.

Review my proposed secret-remediation plan using opaque finding IDs only. For each
verified exposure, identify the issuing service, dependent applications, replacement
rollout, revocation check and access-log review. Keep any history rewrite as a
separately approved, coordinated action. Check prevention with a secret manager,
scoped credentials and pre-commit or push protection where available. Report what is
still unverified. Do not include secret values or automatically change any
credential.

Adapt example paths, commands and acceptance criteria to this repository rather than assuming they match.

Give me a short plan, then make the agreed local changes and run the relevant checks. Report actual results and anything not verified. Stop before credentials, paid services, production changes, push, merge or deployment.