agent/no-prod-secrets-in-agent-reach
No production or unclassified credential sits in a file a coding agent can read.
Install
firedrill hub add agent/no-prod-secrets-in-agent-reach
Reads
repos, files.secrets, files.agent_configs
Fix when it fails
Rotate the credential, move it to a secret manager, and treat a token with no readable scope as full access.
Maps to
SOC2:CC6.1
Test cases
| Case | Expected |
|---|---|
| clean scan | PASS |
| example only | PASS |
| unknown env | FAIL |
| denied to agents | PASS |
| empty | N/A |
Drill file
firedrill: v0
id: agent/no-prod-secrets-in-agent-reach
safeguard: "No production or unclassified credential sits in a file a coding agent can read."
severity: critical
for_each: repos
fetch:
secrets: { fact: files.secrets }
agents: { fact: files.agent_configs }
pass_when:
- secrets.found.filter(s, s.agent_readable && s.env_class in ["prod", "unknown"]).size() == 0
fix: "Rotate the credential, move it to a secret manager, and treat a token with no readable scope as full access."
maps_to: [SOC2:CC6.1]