Copy/paste this into Claude Code/Codex:
"Scan my entire codebase for hardcoded secrets: API keys, database URLs, tokens, passwords, and any credential committed in plain text (including in client-side code and old commits). List every one with its file and line. Then move them to environment variables, show me the .env entries I need, update the code to read from env, and add them to .gitignore. Finally, tell me which exposed keys I should rotate immediately because they may already be compromised."