t.rb

# frozen_string_literal: true

def suspicious?(content)
  re = /
    (
      (master_(key))
      |
      (access_(token|key))
      |
      (secrets_(key))
      |
      (bearer_(token))
    )
    (?<right>
      .{8}
    )
  /xim

  (suspicious = content.match(re)) && !suspicious[:right].match?(/
    ^
    (
      [`'"]
      |
      \s*=\s*['"]*xxx
    )
  /xi)
end

abort 'Suspicious' if suspicious?(ARGF.read)

puts 'OK'