# Secrets detection

> Find exposed keys and tokens, with AI confirming which ones are real.

Source: https://scansuite.eu/documentation/usage/static-code-analysis/secrets-detection
Last reviewed: 2026-10-19

Secrets detection finds exposed keys, tokens and credentials in a repository, in its files and in its Git history. With **Verify secrets with AI**, each secret is also judged in the context of the code around it, so example keys and placeholders are told apart from live ones.

## Turn it on

1. **Open Static Code Analysis in the sidebar**
2. **Under AI Featured Code Analysis, check that Secrets Detection is on**

   It is on by default.
3. **Open its row and check Verify secrets with AI**

   On by default; it needs the team to have AI.
4. **Set the rest of the form and click Start Analysis**

| Option | What it does | Default | When to change it |
|---|---|---|---|
| Secrets Detection | Searches the checkout and its Git history for secrets. | On | Switch off when you only want code findings, for example in Verify Fixes (the form does this for you). |
| Verify secrets with AI | Judges each secret in context and labels it verified or not, with a short assessment. | On | Switch off when the team has no AI, or to save tokens; the secrets are still stored, unjudged. |

The form remembers your choice for the team. Secrets Detection is switched off automatically when you choose **Custom Scope** or **Verify Fixes**, because those modes scan only listed files; you can switch it back on. In **Incremental Scan** and **Monitor Changes** it always scans the whole checkout.

Three scanners contribute findings: Nosey Parker, Gitleaks and TruffleHog. Their results are merged, so the same secret in the same file is stored once.

## What verification does

Secret scanners are noisy by design: they would rather report an example key than miss a live one. With **Verify secrets with AI** on:

- Each secret is labelled verified or not, with a short assessment of what it is.
- Obvious cases, such as placeholders, public keys and test fixtures, are settled without AI, and the same secret repeated across files is judged once, so verification stays cheap.
- A secret that is not confirmed is still stored; verification only decides how it is labelled.
- If the AI is unavailable during the scan, the secret is still stored and is judged on a later scan of the same product with verification on.

With verification off, the obvious cases are still settled; the other secrets are stored with **Verified** False and *disabled* in the **Assessment** column.

## Read the results

Secrets appear on the [Credentials](https://scansuite.eu/documentation/usage/credentials) page, filtered by product. The **Verified** column carries the verdict, the **Assessment** column its classification, and **Details** links to the line in the repository. The Credentials page explains every column and action.

![ScanSuite detected secrets](https://scansuite.eu/static/assets/img/docs/usage/credentials/01.png)

*Detected secrets in the Credentials tab, each with an AI verdict and a link back to the source line*

A verified secret should be rotated and removed from the code; the Products page lists products with verified secrets under *Needs attention*.

> **Warning:** Secrets Detection results are not exported to DefectDojo, given the nature of the data. They stay in ScanSuite, on the Credentials page.