find-credential-usage

Find Credential Usage

Input Parameters

Parameter	Required	Description	Example
credential_to_search	Yes	The API key, token, password, or credential string to search for	sk-svcacct-2HXNWxbX0cap
search_scope	No	full (entire home directory), projects (Code/Herd only), or critical (.env and config files only)	full

Procedure

1. Ask for the credential to search if not provided

2. Search each location and collect results:

   # Environment variables
   env | grep -i "{{SEARCH_TERM}}"
   

Shell profiles

grep -r "{{SEARCH_TERM}}" ~/.zshrc ~/.bashrc ~/.bash_profile ~/.profile ~/.zprofile 2>/dev/null

Shell history

history | grep -i "{{SEARCH_TERM}}"

.env files (home directory, 3 levels deep)

cd ~ && find . -maxdepth 3 -type f -name ".env" -exec grep -l "{{SEARCH_TERM}}" {} ; 2>/dev/null

Project directories

grep -r "{{SEARCH_TERM}}" ~/Code ~/Herd 2>/dev/null | head -50

macOS Keychain

security find-generic-password -w -s "{{SEARCH_TERM}}" 2>/dev/null || echo "Not found in Keychain"

3. Compile results into a markdown report organized by location type (env vars, shell profiles, .env files, keychain, project files)
4. Display a summary with total instance count and file paths

## Notes

- Search runs locally — credentials are not transmitted externally
- Results may include sensitive information; handle the generated report carefully
- Large searches may take several minutes
- Shell history is unsearchable if history logging is disabled

## Example

find all instances where I have used this API key across my system where is this token stored on my machine audit where this API key appears in my files check if this credential is exposed anywhere on my system scan my projects and config files for this secret