AI security: secret detection
This course covers how to catch a hardcoded secret before it reaches a git commit. It looks at what this app's .gitignore already protects and why a filename rule misses secrets typed into ordinary files. It explains the two signals a detector checks together, where secrets should live instead, and why false positives are the hardest part. It also covers asking an AI to review a diff for credentials, what to do once a secret is committed, and building a small regex-based detector in Ruby.
What you'll learn
- ✓The two signals of a hardcoded secret: a sensitive-sounding name and a literal string value
- ✓Keeping secrets out of tracked files with ENV and Rails encrypted credentials
- ✓Telling real secrets apart from false positives such as password_confirmation parameters and test fixtures
- ✓Asking an AI a narrow question about a diff and judging its answer
- ✓Rotating a leaked credential first, then cleaning git history
- ✓Writing a small Ruby method that scans lines for secrets
A secret that reaches git is already compromised
The moment that matters isn't when someone finds a hardcoded API key in a repository. It's git commit, the instant a literal secret value gets written into a commit object. Everything after that, a teammate cloning the repo, a CI runner checking it out, a public fork, is a different way of…
Read the full lesson free →Curriculum
7 lessonsA secret that reaches git is already compromised
Why git commit is the moment to stop a secret, and what a .gitignore entry cannot catch.
What a hardcoded secret looks like to a detector
A detector flags a line only when a sensitive name meets a quoted literal of sufficient length.
Where the secret should live instead
This app's ENV-based SMTP config and the commented Rails credentials pattern both keep secrets out of tracked files.
False positives: the hardest part of detection
How the value-shape check avoids flagging password_confirmation lines, and how to treat test fixtures.
Asking an AI to review a diff for secrets
Hand an AI the diff and a narrow question, then trust only answers that quote a specific line.
Once it's committed, deleting it is not enough
A throwaway repository shows git history keeps deleted secrets, so rotate the credential before cleaning history.
Putting it together: a small secret detector
A challenge to write scan_for_secrets in Ruby, applying the two-signal rule and skipping safe patterns.