SecretGuard

Inspiration

Developers sometimes commit passwords and API keys by mistake. I wanted a reviewer that catches this right inside the merge request.

What it does

SecretGuard is a custom GitLab Duo flow with three agents: Scanner, Fixer and Reporter. When someone mentions the flow on a merge request, it reads the diff, finds hardcoded secrets (API keys, tokens, passwords, database URLs), masks them (only the first 4 characters are shown), suggests fixes, and posts a report comment on the MR.

How I built it

• The flow has the three agents inline (scanner -> fixer -> reporter). The same three custom agents are also public in the AI Catalog.
• Triggers: Mention, Assign, Assign reviewer.
• The repo also has a Python/Flask backend, a plain HTML/JS frontend, tests, AGENTS.md, and a CI/CD pipeline.
• Autonomy level: Assisted. A human approves every fix.
• All secrets in the demo are fake.

Challenges

A flow cannot call a custom agent by name, so I put the same three agents inside the flow. One flow run takes about 2 minutes, so in the video I show the report from an earlier run on the same MR.

What's next

Support more secret types and offer to open a fix MR after human approval.

Built With

• ci/cd
• duo
• flask
• gitlab
• html
• javascript
• python