Leaked secrets
Every new scan also looks for credentials committed to the repository: API keys, access tokens, private keys, database passwords and similar. The Leaked Secrets page in the dashboard lists what was found, with the live ones first.
How secret scanning works
- It runs automatically as the Scanning for Leaked Secrets stage of each scan. There is nothing to turn on.
- It uses TruffleHog detectors, which recognise secrets from hundreds of services such as AWS, GitHub, Slack and database connection strings.
- It checks the files in the branch you scanned. Earlier commits in git history are not checked.
- Each repository shows its most recent scan. Scans made before secret scanning was added are not included, so re-scan a repository to see its results.
Reading the page
Open it from Leaked Secrets in the dashboard menu, or from View all on the Overview's Top 5 Leaked Secrets card.
| Part | What it shows |
|---|---|
| Secrets found | Total findings across the latest scan of each repository. |
| Live secrets | Findings confirmed to still work. Revoke these first. |
| Repos affected | Repositories with at least one finding, out of those scanned for secrets. |
| All / Live only | Shows every finding, or only live ones. |
| Repository card | One per affected repository, with branch, scan time, counts and Open report. |
| No secrets found | Repositories whose latest scan found nothing. |
Each repository card has a table of findings:
| Column | Meaning |
|---|---|
| Status | Live or Unverified. See below. |
| Type | The kind of secret, such as AWS, Github, PrivateKey or Slack. |
| Location | The file and line number. |
| Preview | A masked preview, at most the first 4 characters. Never the full value. |
| Fix | How to rotate opens the provider's rotation guide. Revoke at provider means there is no guide; revoke it in that service's console. |
If a card says Secret scan failed, the scan could not finish checking that repository, for example because it timed out. Run a new scan. If it says Showing the first N of M findings, the repository had more findings than the page can hold; the counts are still complete.
Live and unverified secrets
| Status | Meaning | What to do |
|---|---|---|
| Live | The secret was tested against its provider and still works. | Treat it as compromised. Revoke it now. |
| Unverified | It matches a secret format, but could not be confirmed as working. It may be revoked, a test value, or a provider that can't be checked. | Check it, and rotate it if it is real. |
info
To test a secret, it is sent only to the service that issued it, such as AWS for an AWS key. It is never sent anywhere else.
What we store
- The type of secret, the file, the line, and whether it is live.
- A masked preview of at most 4 characters.
- A fingerprint that lets us recognise the same secret across scans without storing it.
The full secret value is never stored or shown, including to you. See the Privacy Policy.
Fixing a leaked secret
- 1Revoke or rotate the secret with the service that issued it. Use How to rotate when it is shown. Do this first: once a secret is pushed, assume someone has copied it.
- 2Remove it from the code and load it from an environment variable or a secrets manager instead.
- 3Check the provider's logs for any use of the old secret.
- 4Re-scan the repository to confirm the finding is gone.
warning
Deleting a secret from the latest code does not remove it from git history, where it can still be read. Rotating the secret is what makes the leak harmless.