Secret (Secret Detection)
Finds hardcoded secrets left in source code and commit history. A secret that has been committed once must be treated as already leaked, so the key is to find it quickly and revoke it. Used with the Source Code service.
Values it finds
- API keys, access tokens
- Passwords, database connection strings
- Private keys (PEM), cloud credentials
Independent of file format or language. Regex rules detect secrets across all text files and Git commit history.
Viewing results
Each finding shows the file and location where the secret was found. The actual secret value is safely masked in the display.
A secret committed to source must be considered already exposed. Removing it from the code is not enough. Revoke (rotate) the key / token and issue a new one. The value may remain in commit history as-is.
False positive suppression
If a value is not a real secret (such as an example value or a test dummy), you can suppress it as a false positive or use the repository's ignore rules. Suppression is kept by fingerprint, so it will not reappear in the next scan.