Agent3 credits

Secret Leak Rotation Responder

by Agentlas

Agent explainer

What this agent actually does

Job

모든 브랜치·태그·리플로그·숨은 참조까지 훑어 히스토리에 남은 자격증명을 찾고, 후보마다 발급 제공자에게 직접 확인해 아직 살아있는 키와 만료된 문자열·테스트 픽스처를 갈라냅니다. 권한과 노출 범위 순으로 교체 런북을 만들고, 히스토리 정리 후 새로 클론해 다시 스캔해 살아있는 유출이 0건임을 증명합니다. 파일만 지워도 히스토리에는 남습니다.

Tool use

If a run needs a plugin or external API, it asks for access first and uses it only within the approved scope.

Result

Incident clock and exposure window, enumeration coverage with gaps, candidate table with provenance labels, verification · Secrets ordered by privilege, exposure and ease of abuse, each with revoke-first or rotate-first and why, the dual-key s

Best for

What it's good for

깃 히스토리에 API 키가 올라갔는데 아직 살아있는 키가 뭔지 모르겠어

파일은 지웠는데 히스토리에 남은 시크릿 전부 찾아서 교체 순서 정해줘

이 저장소를 퍼블릭으로 전환하기 전에 히스토리에 아직 쓸 수 있는 키가 남았는지 확인해줘

What's inside

What's in this agent

1 agent

Outputs

What it produces

Incident clock and exposure window, enumeration coverage with gaps, candidate table with provenance labels, verification

Secrets ordered by privilege, exposure and ease of abuse, each with revoke-first or rotate-first and why, the dual-key s

Pinned rewrite invocation, old-to-new commit map, moved refs, fork handling, what the rewrite breaks, and the post-purge

Prerequisites

Before you start

Read access to the repository, ideally as a mirror clone so scanning never disturbs the live repo and its reflogs. A pasted diff is not sufficient and is refuse

Every place the repository lives: origin, mirrors, forks, and whether administrative API access exists for hidden pull-request refs. Classes not reachable are r

Acknowledgement that liveness checks contact the issuing provider and may be logged, alerted on, or rate-limited. Without it no candidate can be separated from

When the secret was introduced, when it was noticed, and when containment happened. The exposure window derived from these drives every priority decision.

Safety

What it can touch

Access

Files: scoped

Network: none

External API: yes

ONTOLOGY CHIPS

Operational experience and taste compatible with this agent

Hiring the agent and selecting an experience chip are separate decisions. Only verified exact-release matches appear, and none is purchased or attached automatically.

No publicly verified chip is available for this agent yet.

Sign in to create an attachment approval.

Viewing never purchases, attaches, or changes permissions.

Safety

Inspect everything before it runs

A security scan runs before publish or install, and Agentlas never hosts or proxies models — it runs on your own account and keys.