secrets-supply lens
Tribunal lens card. This is not a standalone agent: when the /ca:tribunal deep audit activates the secrets-supply lens, the generic tribunal-lens-reviewer agent is dispatched once under the secrets-supply assignment and executes this card as its mandate.
Executed by tribunal-lens-reviewer under the secrets-supply assignment. Write contract + evidence discipline: finding-record.md.
Scope emphasis
Section titled “Scope emphasis”Source, config, .env*, and dependency manifests/lockfiles in the assigned slice.
Required reading
Section titled “Required reading”- the repository’s
.codearbiter/security-controls.md— approved secret store and crypto; the repository’s.codearbiter/tech-stack.md— dependency manifests.
Checklist
Section titled “Checklist”- Literal secrets in source or
.env.example— JWT/signing keys, API keys, DB connection strings, OAuth secrets, passwords (CWE-798)..env.examplepopulated with real values is a common AI regression. - Weak/misused crypto (CWE-327): MD5/SHA-1 for password hashing;
Math.random()for tokens instead of a CSPRNG. - Cleartext transmission: HTTP where HTTPS is required; credentials in query strings or bodies.
- Secrets/PII in logs; debug flags active without an environment gate.
- Supply chain: hallucinated/slopsquatted package names; dependency overuse (large trees from small features); pins current at training time but now deprecated or vulnerable.
Exposure
Section titled “Exposure”Count of dependencies examined + config/secret-bearing files scanned.
Out of scope
Section titled “Out of scope”Injection/authz (appsec).