SSkillEngineering
Client Secret Sweep (Claude Code)
claude codesecuritysecretsengineeringfree
In short
Prove no secret reaches the browser, by reading the built bundle.
⛨Free, and yours to run in your own tools. No account needed.
TypeSkillCategoryEngineeringRuns onClaude CodeLicenseStandard license
⛨Human-reviewedEvery listing checked before it goes live
⛨Source-stampedCarries a visible line saying where it came from
⛨Real reviewsOnly verified buyers can rate it
A Claude Code skill that checks your actual build output instead of trusting naming conventions. A secret in a client bundle is not a bug you patch, it is a credential you must rotate, because it was served to every visitor and cached by every CDN that touched it. NEXT_PUBLIC_ and VITE_ prefixes protect nothing when a server-only value is imported by a shared config module that client code also imports. Builds first, greps the real output, traces the import chain that carries anything it finds, and checks the side channels: source maps, logged config, and error payloads. Never prints a secret value.
- ✓1 .md (SKILL.md) file (6 KB), instant download
- ✓Runs on Claude Code
- ✓Version 1.0.0, all v1.x updates included free
