# Credentials

> Secrets and leaked credentials found by scans, your own pairs for the AI scans' login audit, and checking whether they still work.

Source: https://scansuite.eu/documentation/usage/credentials
Last reviewed: 2026-10-19

The **Credentials** page (sidebar, **Library**) holds the secrets and leaked credentials of a product: those found by [secrets detection](https://scansuite.eu/documentation/usage/static-code-analysis/secrets-detection), by the OSINT credential-leakage stage and the Bruteforcer of [Infrastructure Checks](https://scansuite.eu/documentation/usage/infrastructure-checks), and those you add yourself. You can also mark credentials to be tried by the AI scanners when they audit a login form. The page shows one product at a time; choose it in the selector at the top.

![ScanSuite credentials list](https://scansuite.eu/static/assets/img/docs/usage/credentials/01.png)

*The credentials list with source links*

## The list

| Column | What it shows |
|---|---|
| Name | The user name or e-mail. Click it for the full details, including the secret. |
| Product | The product, or Unassigned for a team-wide credential. |
| Secret | Masked. Click to reveal it in full and copy it, if your role may. |
| Verified | Whether the credential is confirmed real (see the note below). Click the chip to toggle it. |
| AI scans | Whether AI DAST and the AI Pentest try it on login forms. Click the chip to toggle it. |
| Assessment | For a secret found in code: the secret type, with the reasoning on hover. |
| Details | Where it was found. For a secret in code, a link to the line in the repository. |
| Actions | The shield approves it as the team's server account (see below); the bin deletes it. |

**Search credentials** matches the user name and the description, never the secret value.

## Adding credentials

1. Choose the product in the selector and open **Add / Edit Credential**.
2. Fill in the fields, or choose a file under **Or upload a file**.
3. > **A person does this step:** Typing a password or hash is done by a person; an agent does not handle credential values.
4. Click **Submit**.

   *Check:* the list reloads with the new credential. A file that cannot be read says *Invalid JSON file* with the reason.

| Field | What it holds | Default |
|---|---|---|
| Username/email | The account. | Empty |
| Password/hash | The secret. | Empty |
| Description | Free text, shown in the Details column; for a link, the address. | Empty |
| Verified | Marks the credential as confirmed real. | Off |
| Use in AI scans | Lets AI DAST and the AI Pentest try it on login forms. | Off |
| Or upload a file | A JSON list, or a LeakPeek export (.xls or .xlsx). Uploaded credentials arrive unverified and not used in AI scans. | None |

To edit a credential, click its row (not its name): the form fills with it. Change the fields and click **Submit**. **Add Credential** clears the form for a new entry.

A JSON upload is a list of objects. Each needs a user (`email`, `username` or `name`) and a secret (`password` or `hashed_password`); `database_name` becomes the description. Entries without both are skipped.

*credentials.json*

```
[
  {"email": "j.doe@example.com", "password": "example-password", "database_name": "example-breach-2025"},
  {"username": "admin", "hashed_password": "$2y$10$abc...", "database_name": "forum-dump"}
]
```

![Credentials input form](https://scansuite.eu/static/assets/img/docs/usage/credentials/02.png)

*Adding credentials manually or in bulk*

## Acting on several credentials

Tick credentials, then use the toolbar:

| Button | What it does |
|---|---|
| Mark verified, Mark unverified | Sets the Verified mark. |
| Mark for AI scans, Unmark AI scans | Sets the AI scans mark. |
| Export to XLSX | Exports the ticked credentials, or all of the product when none is ticked. Reads Export selected with a selection. |
| Export verified to XLSX | Exports only the verified ones. |
| Delete selected | Deletes the ticked credentials. |
| Clear Credentials | Deletes every credential of the product. |

## Use your own credentials in the default-credential audit

When AI DAST or the AI Pentest finds a login form, it tries a built-in list of default and common credentials. Credentials you mark here are tried as well, on top of that list. Use it for the accounts you know a product's apps ship with, or for leaked pairs you want checked. Nothing is marked by default.

1. Choose the product in the selector. Credentials of that product are used for its scans; team-wide credentials (Product: Unassigned) are used for every product.
2. Tick the credentials and click **Mark for AI scans**, or tick **Use in AI scans** when adding one.

   *Check:* their **AI scans** chip reads True.
3. Run [AI DAST](https://scansuite.eu/documentation/usage/web-app-scanning) or an [AI Pentest](https://scansuite.eu/documentation/usage/ai-pentest) against the product's app.
4. *Check:* a pair that logs in is reported as a finding of the scan, on its page and on the Vulnerabilities page.

A credential without a user name is skipped. Marking changes only what the AI scanners try; the scan's other settings are unchanged.

> **Warning:** Login attempts can lock accounts on the target. Mark only credentials you are allowed to try against that application.

![ScanSuite Credentials ticked in the list](https://scansuite.eu/static/assets/img/docs/usage/credentials/08.png)

*Credentials ticked in the list: Mark for AI scans adds them to the default-credential audit*

## Verifying whether they still work

The **Bruteforcer** scanner of [Infrastructure Checks](https://scansuite.eu/documentation/usage/infrastructure-checks) tries the product's stored login and password pairs against the services it finds. A pair that works is logged in the scan log as *Credentials confirmed!!* and added to the list as a new, verified credential whose Details record where it worked.

![Credential details](https://scansuite.eu/static/assets/img/docs/usage/credentials/06.png)

*A credential detail view, with the source link back to the offending line*

> **Two meanings of verified:** A secret found in code is marked verified when the scanner, a detection rule or the AI model judges it to be a real credential rather than an example; the **Assessment** column shows the secret type, and its hint the reasoning. A login and password pair is marked verified when the Bruteforcer authenticated with it. Anyone who may change credentials can set the mark by hand.

> **Danger:** A confirmed working credential is a live compromise. Rotate it before filing it.

## Using a credential for authenticated scans

Credentials on this page are findings; scans never log in with them on their own (the AI scans mark above only adds them to the default-credential audit). When a found login should become the account that authenticated infrastructure checks use, click the shield, **Approve as the team's server account for authenticated scans**, and confirm. Scans queued from then on use it. The approved account can also be entered or replaced in the **Server account** card on the **Scanning** tab of the **Teams** page.

![ScanSuite credential approve for scans action](https://scansuite.eu/static/assets/img/docs/usage/credentials/07.png)

*The shield icon approves a found credential as the team server account*

## Who can do what

Credentials belong to the team: other teams never see them.

| Action | Roles |
|---|---|
| See that a credential exists and where it was found | Every role |
| Reveal a secret, open the details, export | Vulnerability manager, Operator, Team admin |
| Add, edit, mark verified, mark for AI scans | Vulnerability manager, Operator, Team admin |
| Delete, Delete selected, Clear Credentials | Operator, Team admin |
| Approve as the team's server account | Operator, Team admin |

See [Teams and roles](https://scansuite.eu/documentation/administration/teams-and-roles).