Run scans

Secrets detection

Find exposed keys and tokens, with AI confirming which ones are real.

View as Markdown

Secrets detection finds exposed keys, tokens and credentials in a repository, in its files and in its Git history. With Verify secrets with AI, each secret is also judged in the context of the code around it, so example keys and placeholders are told apart from live ones.

Turn it on

  1. 01
    Open Static Code Analysis in the sidebar
  2. 02
    Under AI Featured Code Analysis, check that Secrets Detection is on

    It is on by default.

  3. 03
    Open its row and check Verify secrets with AI

    On by default; it needs the team to have AI.

  4. 04
    Set the rest of the form and click Start Analysis
OptionWhat it doesDefaultWhen to change it
Secrets DetectionSearches the checkout and its Git history for secrets.OnSwitch off when you only want code findings, for example in Verify Fixes (the form does this for you).
Verify secrets with AIJudges each secret in context and labels it verified or not, with a short assessment.OnSwitch off when the team has no AI, or to save tokens; the secrets are still stored, unjudged.

The form remembers your choice for the team. Secrets Detection is switched off automatically when you choose Custom Scope or Verify Fixes, because those modes scan only listed files; you can switch it back on. In Incremental Scan and Monitor Changes it always scans the whole checkout.

Three scanners contribute findings: Nosey Parker, Gitleaks and TruffleHog. Their results are merged, so the same secret in the same file is stored once.

What verification does

Secret scanners are noisy by design: they would rather report an example key than miss a live one. With Verify secrets with AI on:

  • Each secret is labelled verified or not, with a short assessment of what it is.
  • Obvious cases, such as placeholders, public keys and test fixtures, are settled without AI, and the same secret repeated across files is judged once, so verification stays cheap.
  • A secret that is not confirmed is still stored; verification only decides how it is labelled.
  • If the AI is unavailable during the scan, the secret is still stored and is judged on a later scan of the same product with verification on.

With verification off, the obvious cases are still settled; the other secrets are stored with Verified False and disabled in the Assessment column.

Read the results

Secrets appear on the Credentials page, filtered by product. The Verified column carries the verdict, the Assessment column its classification, and Details links to the line in the repository. The Credentials page explains every column and action.

ScanSuite detected secrets
Detected secrets in the Credentials tab, each with an AI verdict and a link back to the source line

A verified secret should be rotated and removed from the code; the Products page lists products with verified secrets under Needs attention.

Secrets Detection results are not exported to DefectDojo, given the nature of the data. They stay in ScanSuite, on the Credentials page.

Last reviewed 2026-10-19