Secret Scanner

Detect leaked API keys, tokens, and credentials across Git commits and env files, with entropy scoring and per-finding triage.

Overview

Secret Scanner detects leaked API keys, tokens, and credentials across Git commits and environment files. Instead of storing or managing secrets, it scans your repository history and working tree — commits, .env files, and configuration files — for patterns that look like hardcoded credentials, and reports each one with its exact file, line, commit, author, and a Shannon entropy score that estimates how likely the string is a real secret versus a benign value.

Detection, not storage

Secret Scanner is a detection tool — it does not store or manage credentials for you. Once a leaked secret is found, rotate it in the system that issued it (AWS, GitHub, Stripe, etc.) and mark the finding as Revoked here for your own tracking.

Quick Start

Open Secret Scanner from the Security sidebar.
If you have not connected a Git provider yet, click Connect Git to link GitHub, GitLab, or Bitbucket in Settings → Integrations — or click Sample Results to explore the UI with mock findings first.
Enter the repository path or URL and click Scan Now. The scan reads commit history, .env files, and config files.
Review findings in the results table — filter by status (Active / Revoked / False Positive) or secret type, and search by file, kind, or commit.
Click a row to open the detail panel: the redacted code snippet, entropy score, commit/author/date, and the value (toggle Reveal / Redact).
Use the action buttons to mark a finding Active, Revoked, or False Positive for your own tracking — this does not rotate or revoke the credential itself.

Detected Secret Types

AWS Access & Secret Keys

AWS access key IDs and secret access keys embedded in config files or source.

GitHub & GitLab Tokens

Personal access tokens and OAuth tokens for GitHub and GitLab.

Stripe & SendGrid Keys

Live API keys for Stripe payments and SendGrid transactional email.

Private Keys

RSA/SSH private key blocks (-----BEGIN ... PRIVATE KEY-----) committed by mistake.

Database URLs

Connection strings with embedded username/password (postgres://user:pass@host).

JWT Secrets & Generic API Keys

Hardcoded JWT signing secrets and generic high-entropy API key strings.

Finding Statuses

Status	What it means
Active	Secret is exposed and not yet rotated.
Revoked	Secret has been rotated or invalidated at the source.
False Positive	This is a test value or a known-safe string, not a real secret.

AI Assistant

Every screen in Security Hub now ships with an embedded AI Assistant, opened from the vertical AI Assistant tab on the right edge of the screen. The assistant reads the data currently on screen — the current findings list, or the single finding you have selected — and answers questions, triages findings, or drafts a remediation plan directly in the chat panel.

Triage Suggestions

Ask the assistant to recommend a status (Active / Revoked / False Positive) for the current findings, with reasoning tied to the specific file, commit, and author.

Duplicate Detection

Find out whether the same secret leaked across multiple commits, so you rotate it once instead of chasing each occurrence separately.

Remediation Checklist

Generate a step-by-step remediation checklist (rotate key, purge from history, update .gitignore) for the active findings.

Save as Report & Add Knowledge

Any assistant reply can be saved as a report (available later from My Reports) via the Save as Report button under the last message. Click Add Knowledge in the input dock to attach files or notes from your Knowledge library so the assistant's answers can reference them.

FAQ

Does Secret Scanner store the secret values it finds?

No. Findings are shown with a redacted value by default (toggle Reveal to see the raw match in your own session). Secret Scanner does not persist plaintext secret values to a separate vault.

What happens when I mark a finding as Revoked?

This only updates the status shown in Secret Scanner for your own tracking — it does not call out to AWS, GitHub, Stripe, etc. to actually rotate the credential. You must rotate the real credential at its source first.

Can I explore the UI without connecting a Git provider?

Yes — click Sample Results on the idle screen to load mock findings and try every feature (filters, detail panel, redact/reveal, status actions, AI Assistant) before connecting a real repository.