Exposure
secrets in source, config, Dockerfiles, CI files, notebooks, and git history.
The pack · 10 / 14 →
Secrets
Akita
the secrets dog. Finds secrets in code and git history, helps rotate them and blocks them at commit.
config.ts
12export const config = {
13 region: "ap-south-1",
14 stripeKey: "sk_live_••••••••", stripeKey: process.env.STRIPE_KEY,
15 port: 8080,
16};
Live secret in code
ExploitAnyone with repo access can charge cards
FixSmallest change suggested
Akita is watching$ /watchdog-go-secrets0 found · 0 fixed
What it does
On duty while you build.
The secrets dog. Goes past finding keys: rotation, storage, .env handling, git history cleanup and pre-commit blocking.
The always-on lens watches .env files, config, CI secrets, vaults, key rotation, git history.
What it checks
6 things Akita looks for.
Storage
plaintext .env committed, secrets in container images or mobile/web bundles, no vault/secret manager.
Scope
one key shared across environments or services; admin keys where scoped keys exist.
Rotation
no rotation path; leaked keys still valid; long-lived tokens instead of short-lived/OIDC.
Prevention
no pre-commit or CI secret scanning; `.gitignore` missing `.env`.
Cleanup
after a leak: rotate first, then purge history (`git filter-repo`), then invalidate caches and forks.
Commands
Send Akita out.
Runs these scanners when installed, then reads the code they can't understand:
- pre-commit
Find, rotate and properly store secrets; git history; pre-commit blocking
- /watchdog-go-web
- /watchdog-go-mobile
- /watchdog-go-ai-app
- /watchdog-go-infra
- /watchdog-go-defi
- /watchdog-go-all
Also runs in these bundles.
Benchmark
Tested, not promised.
Its test target holds a small service with .env, config, CI workflow, weak .gitignore and pre-commit config: 18 planted issues, 3 decoys and an answer key. All values are labelled FAKE-....
found
Haiku 5.518/18
Sonnet 5.517/18
Opus 5.517/18
Rules of engagement
What Akita will never do.
- 1
Static review only. Never change live systems or send traffic to targets outside the user's written scope.
- 2
Never print a secret's value — not keys, tokens or passwords, even weak defaults. Give file:line and the secret type only.
- 3
End each review with: what you did not check, and the top risk the user must act on.
FAQ
Akita, answered.
What does Akita check for?
Akita is Watchdog's secrets dog for Claude Code. It looks for Exposure, Storage, Scope, Rotation, Prevention and Cleanup. Each finding comes with the exact file and line, how it could be abused, and the smallest fix.
How do I run Akita in Claude Code?
Install Watchdog with /plugin marketplace add watchdoglab/watchdog and /plugin install watchdog@watchdog, then run /watchdog-go-secrets. Its lens also stays on while you code and flags risky lines as they're written.
Which tools does Akita use?
When they're installed, Akita runs pre-commit, then reads the code those scanners can't understand. Anything it couldn't check is listed under Not checked in the report.
Is Akita safe to run on my project?
Yes. Its first rule: Static review only. Never change live systems or send traffic to targets outside the user's written scope. Secrets it finds are reported by location and type only, never printed. Watchdog is free and open source (MIT).