\r \r

EnvGuard — Pre-Commit Secret Detection\r

\r EnvGuard scans your code for leaked secrets, credentials, API keys, and .env file contents before they reach git. It uses regex-based pattern matching against 50+ secret formats from 20+ services, lefthook for git hook integration, and produces SARIF-compatible reports for compliance workflows.\r \r

Commands\r

\r

Free Tier (No license required)\r

\r

envguard scan [file|directory]\r

One-shot secret scan of files or directories.\r \r How to execute:\r

bash "\x3CSKILL_DIR>/scripts/envguard.sh" scan [target]\r
```\r
\r
**What it does:**\r
1. Accepts a file path or directory (defaults to current directory)\r
2. Finds all text files (excluding .git/, node_modules/, dist/, build/, vendor/, __pycache__)\r
3. Runs 50+ secret detection patterns against each file\r
4. Respects .envguardignore exclusions (gitignore syntax)\r
5. Outputs findings with: file, line number, pattern matched, severity, redacted match\r
6. Exit code 0 if clean, exit code 1 if critical/high findings detected\r
\r
**Example usage scenarios:**\r
- "Scan this repo for leaked secrets" -> runs `envguard scan .`\r
- "Check this file for API keys" -> runs `envguard scan src/config.ts`\r
- "Are there any secrets in my source code?" -> runs `envguard scan src/`\r
\r
### Pro Tier ($19/user/month -- requires ENVGUARD_LICENSE_KEY)\r
\r
#### `envguard hooks install`\r
Install git pre-commit hooks that scan staged files for secrets before every commit.\r
\r
**How to execute:**\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/envguard.sh" hooks install\r
```\r
\r
**What it does:**\r
1. Validates Pro+ license\r
2. Copies lefthook config to project root\r
3. Installs lefthook pre-commit hook\r
4. On every commit: scans all staged files for secrets, blocks commit if secrets found, shows remediation advice\r
\r
#### `envguard hooks uninstall`\r
Remove EnvGuard git hooks.\r
\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/envguard.sh" hooks uninstall\r
```\r
\r
#### `envguard allowlist [add|remove|list] [pattern]`\r
Manage false positive patterns. Allowlisted patterns are skipped during scanning.\r
\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/envguard.sh" allowlist add "EXAMPLE_API_KEY_FOR_TESTS"\r
bash "\x3CSKILL_DIR>/scripts/envguard.sh" allowlist remove "EXAMPLE_API_KEY_FOR_TESTS"\r
bash "\x3CSKILL_DIR>/scripts/envguard.sh" allowlist list\r
```\r
\r
**What it does:**\r
1. Validates Pro+ license\r
2. Reads/writes allowlist in ~/.openclaw/openclaw.json (envguard.config.allowlist)\r
3. Allowlisted patterns are treated as known-safe and skipped during scans\r
\r
#### `envguard diff`\r
Scan only staged changes (git diff --cached) for secrets.\r
\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/envguard.sh" diff\r
```\r
\r
**What it does:**\r
1. Validates Pro+ license\r
2. Gets staged changes via `git diff --cached`\r
3. Scans only added/modified lines for secrets\r
4. Ideal for pre-commit checks on large repos\r
\r
### Team Tier ($39/user/month -- requires ENVGUARD_LICENSE_KEY with team tier)\r
\r
#### `envguard history [directory]`\r
Full git history scan -- finds secrets in all previous commits.\r
\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/envguard.sh" history [directory]\r
```\r
\r
**What it does:**\r
1. Validates Team+ license\r
2. Walks entire git log using `git log -p`\r
3. Scans every diff for secrets across all commits\r
4. Reports: commit hash, author, date, file, line, pattern matched\r
5. Critical for onboarding repos that may have had secrets committed in the past\r
\r
#### `envguard report [directory]`\r
Generate a SARIF-compatible or markdown compliance report.\r
\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/envguard.sh" report [directory]\r
```\r
\r
**What it does:**\r
1. Validates Team+ license\r
2. Runs full scan of the directory\r
3. Generates a formatted markdown report with severity breakdown\r
4. Includes remediation steps for each finding category\r
5. Output suitable for compliance audits and security reviews\r
\r
#### `envguard policy [directory]`\r
Custom secret patterns and enforcement rules.\r
\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/envguard.sh" policy [directory]\r
```\r
\r
**What it does:**\r
1. Validates Team+ license\r
2. Loads custom patterns from ~/.openclaw/openclaw.json (envguard.config.customPatterns)\r
3. Enforces organization-specific secret rules (e.g., internal token formats)\r
4. Combines custom patterns with built-in patterns for comprehensive scanning\r
\r
## Detected Secret Types\r
\r
EnvGuard detects 50+ secret patterns across 20+ services:\r
\r
| Category | Examples | Severity |\r
|----------|----------|----------|\r
| AWS Credentials | AKIA* keys, aws_secret_access_key | Critical |\r
| Stripe Keys | sk_live_*, sk_test_*, rk_live_*, whsec_* | Critical |\r
| GitHub Tokens | ghp_*, gho_*, ghu_*, ghs_*, ghr_* | Critical |\r
| GitLab Tokens | glpat-* | Critical |\r
| Private Keys | RSA, OPENSSH, DSA, EC, PGP private keys | Critical |\r
| Slack Tokens | xoxb-*, xoxp-*, xoxo-*, xapp-* | High |\r
| Google API Keys | AIza* | High |\r
| JWT Tokens | eyJ* (long base64 tokens) | High |\r
| Database URIs | postgres://, mysql://, mongodb://, redis:// | High |\r
| Twilio Keys | SK* account SIDs | High |\r
| SendGrid Keys | SG.* | High |\r
| Firebase/Supabase | API keys and service tokens | High |\r
| npm Tokens | npm_* | High |\r
| Heroku API Keys | Heroku token patterns | Medium |\r
| DigitalOcean | dop_v1_*, doo_v1_* | Medium |\r
| Azure Keys | Azure subscription/account keys | Medium |\r
| Cloudflare | API tokens and keys | Medium |\r
| Docker Hub | Docker auth tokens | Medium |\r
| Mailgun/Postmark | API keys | Medium |\r
| Generic Secrets | api_key=, password=, secret=, token= | Low |\r
| .env Leaks | KEY=value patterns in source files | Low |\r
\r
## Configuration\r
\r
Users can configure EnvGuard in `~/.openclaw/openclaw.json`:\r
\r
```json\r
{\r
  "skills": {\r
    "entries": {\r
      "envguard": {\r
        "enabled": true,\r
        "apiKey": "YOUR_LICENSE_KEY_HERE",\r
        "config": {\r
          "severityThreshold": "high",\r
          "allowlist": [],\r
          "customPatterns": [],\r
          "excludePatterns": ["**/node_modules/**", "**/dist/**", "**/.git/**"],\r
          "reportFormat": "markdown"\r
        }\r
      }\r
    }\r
  }\r
}\r
```\r
\r
## Important Notes\r
\r
- **Free tier** works immediately with no configuration\r
- **All scanning happens locally** -- no code or secrets are sent to external servers\r
- **License validation is offline** -- no phone-home or network calls\r
- Supports .envguardignore files (gitignore syntax) to exclude paths\r
- Matches are always **redacted** in output (first/last 4 chars only)\r
- Git hooks use **lefthook** which must be installed (see install metadata above)\r
- Exit codes: 0 = clean, 1 = findings detected (for CI/CD integration)\r
\r
## Error Handling\r
\r
- If lefthook is not installed and user tries `hooks install`, prompt to install it\r
- If license key is invalid or expired, show clear message with link to https://envguard.pages.dev/renew\r
- If a file is binary, skip it automatically with no warning\r
- If .envguardignore is malformed, warn and continue with default excludes\r
- If no files found in target, report clean scan with info message\r
\r
## When to Use EnvGuard\r
\r
The user might say things like:\r
- "Scan for leaked secrets"\r
- "Check if any API keys are in my code"\r
- "Set up secret scanning on my commits"\r
- "Are there any credentials in this repo?"\r
- "Generate a security report for compliance"\r
- "Scan git history for leaked passwords"\r
- "Block secrets from being committed"\r
- "Check my staged files for secrets"\r
- "Add a false positive to the allowlist"\r