Intune stores script bodies base64-encoded and does not let you search them in the portal, so a credential pasted into a Remediation or platform script tends to sit there unnoticed, readable by anyone with DeviceManagementConfiguration.Read.All and written to every managed device that runs it.
This script decodes every Remediation and platform script in the tenant and scans each one three ways: named assignments like $ClientSecret, distinctive credential formats (Entra secrets, PEM keys, JWTs, SAS tokens, connection strings), and high-entropy strings that look like a key hiding under an unhelpful variable name. Findings are reported with the value redacted, and it is read-only. Run it, then rotate anything it finds and move the secret to a managed identity or Key Vault.
