apiVersion: devrunbook.io/v1alpha1 kind: Playbook metadata: id: security-reliability.secrets-exposure-audit slug: secrets-exposure-audit version: 1.0.0 title: Secrets Exposure Audit summary: Inspect repository and runtime configuration patterns for committed, logged or exported secrets without echoing sensitive values. category: security-reliability tags: - secrets - security - logging lifecycle: reviewed riskTier: critical authors: - name: DevRunbook Core Team license: MIT package: files: - path: prompt.md role: template digest: true exportByDefault: false - path: README.md role: documentation digest: true exportByDefault: false - path: CHANGELOG.md role: changelog digest: true exportByDefault: false - path: examples/minimal.yaml role: example digest: true exportByDefault: false - path: evaluations/static-structure.yaml role: evaluation digest: true exportByDefault: false spec: type: guided intent: problem: Development work around secrets exposure audit is often underspecified, inconsistently executed or reported without enough evidence. outcome: Inspect repository and runtime configuration patterns for committed, logged or exported secrets without echoing sensitive values. whenToUse: - Use this playbook when the repository needs a bounded secrets exposure audit task with explicit evidence and completion criteria. - Use it when Codex should follow a repeatable workflow rather than improvise from a one-line request. whenNotToUse: - Do not use it when the desired outcome or authority boundaries are still materially undecided. - Do not use it to access unavailable production credentials, bypass safeguards or claim validation that cannot be performed. modes: - inspect - plan defaultMode: inspect autonomy: min: observe max: diagnose default: diagnose inputs: - key: scope label: Scope description: Describe the repository, application and deployment boundaries to assess. type: multiline required: true sensitive: false includeInOutput: true - key: redactionPolicy label: Redaction policy description: Choose how potential secret findings should be represented in evidence and reports. type: enum required: true sensitive: false includeInOutput: true default: mask-all-values options: - mask-all-values - show-safe-prefix-only - hash-identifiers compatibility: repositoryRequired: true languages: [] frameworks: [] packageManagers: [] databases: [] deploymentTypes: [] requiredProfileCapabilities: [] incompatibleConditions: [] guardrails: - id: guardrail-1 severity: blocking text: Never print, copy or store complete secret values. - id: guardrail-2 severity: blocking text: Do not test credentials against external services. - id: guardrail-3 severity: blocking text: Treat history rewriting and credential rotation as separate explicitly approved operations. workflow: - id: define-patterns title: Define exposure surface instruction: Identify repositories, history, artifacts, logs, environment files and generated output in scope. required: true - id: scan-current title: Scan current tree safely instruction: Use secret-detection patterns and manual context review while redacting matches. required: true - id: scan-history title: Inspect history where allowed instruction: Check Git history and removed files without reproducing secret content. required: true - id: classify-findings title: Classify findings instruction: Distinguish real credentials, test fixtures, hashes, public keys and placeholders. required: true - id: trace-exposure title: Trace impact instruction: Identify potential consumers, publication paths and affected environments without validating credentials. required: true - id: recommend-response title: Recommend response instruction: Prioritize rotation, revocation, removal, prevention and history remediation steps. required: true - id: verify-prevention title: Verify prevention controls instruction: Review ignore rules, scanners, CI and redaction behavior. required: true validation: commandRoles: - security-scan checks: - id: check-1 type: assertion description: Potential secrets are reported only through redacted identifiers and evidence locations. blocking: true evidence: Referenced files, command results or explicit review notes. - id: check-2 type: assertion description: Response guidance separates immediate rotation from repository cleanup and prevention. blocking: true evidence: Referenced files, command results or explicit review notes. - id: command-security-scan type: command description: Run the resolved security-scan command when the repository profile provides it and record the result. blocking: false evidence: Resolved command, exit status and concise result summary. completion: criteria: - Potential exposures are safely fingerprinted, not reproduced. - Rotation and containment actions are prioritized. - Validation evidence and unresolved limitations are reported honestly. failurePolicy: onValidationFailure: Investigate failures caused by the current work, repair them when they remain within scope, rerun affected validation and report any genuine blocker without claiming success. onAmbiguity: Use repository evidence and existing conventions for minor reversible choices. Preserve current behavior and stop before any material irreversible decision that the specification does not resolve. onMissingContext: Inspect the repository for missing non-sensitive context. Never invent commands, credentials, production behavior or validation results; report what remains unavailable. onOutOfScopeCause: Explain the evidenced out-of-scope cause, avoid unrelated changes and provide the smallest safe follow-up recommendation. onExternalDependencyUnavailable: Use an approved local substitute or fixture only when it preserves the behavior under test. Otherwise record the blocked validation and do not claim the external path succeeded. onUnableToReproduce: Record attempted reproduction, environment and observed evidence. Do not apply speculative production changes; provide the narrowest next diagnostic action. reporting: sections: - id: outcome title: Outcome required: true description: State the delivered result or audit conclusion without overstating evidence. - id: evidence title: Evidence and scope required: true description: List inspected or changed areas and the evidence supporting the result. - id: validation title: Validation required: true description: Report commands, manual checks and their actual outcomes. - id: risks title: Risks and limitations required: true description: State residual risk, inaccessible evidence and untested conditions. - id: follow-up title: Recommended follow-up required: true description: List the smallest useful next actions or state None. template: main: prompt.md partials: [] exports: prompt: true markdown: true runPack: false agentsSuggestion: false quality: reviewStatus: editorial-reviewed testedStacks: [] knownLimitations: - Repository-specific effectiveness depends on the accuracy of the selected profile and the evidence available to Codex. evaluationCaseIds: - secrets-exposure-audit.static-structure