---
name: validate-secret-exposure
description: Evidence bar for leaked credentials, tokens, signing material, API keys and private keys - disclosure, liveness and privilege. Use when validating a finding whose impact is a leaked or hardcoded secret.
---

# Validate secret exposure

- Assess the disclosed value's type, provenance and supported access from linked evidence; a prefix or identifier does not establish exposure of a usable secret.
- Distinguish disclosure from validity and privilege. A leaked secret counts once it is shown live: one read-only call with it against the API it belongs to, such as an identity call (GitHub `GET /user`, AWS `sts get-caller-identity`), returning real data. Do not list, read or change what it reaches beyond that call, and never use credentials reached through SSRF or command execution.
- Distinguish exposure caused by the assessed product from public breach data, researcher-created credentials, documentation examples, and secrets that cannot affect an in-scope system.
- The report never shows the complete value: redact it as the `write-finding-report` skill's Redaction section says, and state what the attached PoC prints. Keep the exact evidence linked to the finding.