Secrets detection

Secrets detection finds exposed keys, tokens and credentials in a repository. Enable it with Secrets Detection on the Static Analysis page, and optionally Verify secrets with AI alongside it.

Scanners

Three scanners contribute findings — Parker, Gitleaks and TruffleHog. Each describes the same kind of event in its own format, so every entry is normalised once and then travels a single pipeline. The result is one credential record per finding, visible in Credentials.

What AI verification changes

Secret scanners are noisy by design — they would rather report an example key than miss a live one. With verification enabled, the model judges each finding and the verdict is recorded next to it.

Verification is optional. When it is off, findings are still recorded and marked unverified with the source disabled; a later scan that does have verification available will judge them.

How a finding is judged

1. 01
   Path prefilter

   Findings in ignored paths are dropped and never stored at all — test fixtures and vendored directories do not need a verdict.

2. 02
   Already known?

   If this product has already seen and judged the same secret, it is skipped at no cost. If it was seen but never judged, it is re-verified.

3. 03
   Deterministic ladder

   A set of rules settles the clear-cut cases without a model call.

4. 04
   Cache lookup

   One verdict per distinct secret value per scan, so a key repeated across twenty files costs one judgement.

5. 05
   Evidence

   A commit-accurate source window around the finding is read, so the model judges the secret in context rather than as a bare string.

6. 06
   Verdict

   The model returns a structured verdict. If it is unreachable or its reply cannot be parsed, the platform falls back to a value-shape heuristic rather than dropping the finding.

Re-verifying stored credentials

Credentials stored by an earlier scan that never received a verdict can be judged later without re-running the scan. This is a maintenance operation run on the worker rather than from the console.

What you do with the results

Findings appear in Credentials, with a link straight to the offending code line. Credentials that match a login/password pattern can then be checked for validity by the Bruteforcer scanner — a confirmed credential is a different conversation from a suspected one.