Credentials

Credentials found during static code analysis — secrets detection — and during infrastructure checks such as the OSINT credential-leakage stage or the Bruteforcer scan are saved here and managed from the Credentials page.

The link on each entry refers directly to the code line, so the issue can be checked immediately:

Adding credentials manually

Leaked credentials can be entered by hand or uploaded in bulk as a JSON list:

Verifying whether they still work

Credentials matching a login/password pattern can be used by the Bruteforcer scanner to check their validity. Run it from the infrastructure page:

Confirmed credentials are alerted in the scan logs:

And updated in the Credentials tab through the Verified and Details fields:

Click a credential name for the full details: