Scan App Configs for Exposed Secrets

Fetches a remote application configuration and uses an LLM to detect accidentally exposed API keys or sensitive tokens.

$ curl -sL https://api.example.com/config.json | jq -r '. | to_entries | map("\(.key): \(.value)") | .[]' | llm -s "Analyze this configuration data for any exposed API keys, private tokens, or passwords. Return only the findings or 'No secrets found'."

1. [01] curlcurl -sL https://api.example.com/config.json
   Fetches the remote configuration file silently (-s) and follows any redirects (-L).
2. [02] jqjq -r '. | to_entries | map("\(.key): \(.value)") | .[]'
   Converts the JSON object into a flat list of 'key: value' strings, stripping quotes for cleaner LLM ingestion and reducing token overhead.
3. [03] llmllm -s "Analyze this configuration data..."
   Acts as a security scanner, using the system prompt (-s) to instruct the model to identify and flag potential secrets in the piped text.

Analyzing configuration...
⚠️ Potential secrets detected:
- AWS_ACCESS_KEY_ID: AKIAIOSFODNN7EXAMPLE
- STRIPE_SECRET: sk_live_4eC39HqLyjWDarjtT1zdp7dc

Action recommended: Revoke these keys immediately and rotate credentials.

• Footgun: Sending massive JSON payloads will exceed LLM context windows or cause truncation, potentially missing exposed secrets.
• Privacy/Cost: Sending potentially sensitive internal configurations to a third-party LLM API may violate company data policies; consider using a local model via `llm -m local-model`.