Secrets Detection
Scan every file and commit pattern for API keys, tokens, and credentials that should never be public.
Overview: Accidentally pushing an API key or database credential to a public repository can be catastrophic. The Secrets Detection tool acts as your last line of defense, scanning your codebase for high-entropy strings and recognizable key formats from hundreds of providers. It ensures that sensitive data stays in your environment variables, not your source code.
What We Check For
- [1]Cloud provider keys (AWS/GCP/Azure)
- [2]Database connection strings
- [3]Third-party API tokens (Stripe, Supabase, OpenAI, etc.)
- [4]Private keys/certificates
- [5]Hardcoded passwords
- [6]Secrets in config files and committed .env files
Sample Finding
Severity: Critical
Title: Stripe Secret Key Found in Client-Side Code
Description: A Stripe secret key (sk_live_...) was found hardcoded in a frontend React component, exposing it to anyone viewing the compiled source code.
Remove the key immediately, rotate it in your Stripe dashboard, and move the billing logic to a secure backend endpoint.
Make Secrets Detection a mandatory check before publishing any code to a public repository or deploying to production. It gives you peace of mind that no sensitive credentials are slipping through the cracks.
Audit My Code