What Is Secrets Detection?
Secrets detection is the practice of scanning source code, commit history and configuration for exposed credentials such as API keys, access tokens, passwords and private keys, so they can be revoked and rotated before an attacker finds them.
Also known as:
How Secrets Detection Works
Secrets scanners look for credentials in places they should not be, such as source files, commit history, configuration and CI logs. Most combine two approaches.
- Pattern matching. Structured credentials, such as cloud access keys, have recognizable formats that rules can match reliably.
- Context and entropy. Free-form secrets, like a password in a config file, need surrounding context or randomness checks to find.
Because a secret stays in git history after it is deleted from the latest commit, scanning the full history matters as much as scanning new changes.
Why Secrets Detection Matters
A leaked credential gives an attacker direct access without needing to find a vulnerability first. Hard-coded credentials are a recognized weakness, tracked by MITRE as CWE-798. Once a secret is pushed to a shared repository, it should be treated as compromised.
Live vs Inactive Secrets
Not every match is an active risk. Some secrets have already been rotated, belong to test accounts or were never valid. Verifying whether a credential still authenticates lets a team fix live secrets first, instead of working through every match in the order it was found.
Responding to a Leaked Secret
- Revoke or rotate the credential with the provider.
- Check provider logs for use of the credential while it was exposed.
- Remove it from code and move it to a secrets manager.
- Add pre-commit or pull request checks so it does not happen again.
How Nullify Handles Secrets Detection
Nullify combines pattern matching for structured credentials with NLP for free-form secrets, and checks candidates against providers including AWS, GCP, Azure, GitHub, GitLab, Stripe and Slack to confirm which are live. Live secrets rank above dead or rotated ones, and each finding is tagged with a suspected owner and rotation guidance. Rotation itself stays with your team and the provider. See how Nullify detects and verifies secrets.
Key Takeaways
- Secrets detection finds credentials exposed in code, history and configuration.
- A secret in git history stays exposed even after it is deleted from the latest commit.
- Verifying which secrets are live lets teams rotate the dangerous ones first.
- Rotate first, then remove the secret from code and prevent it from recurring.
Read More About Secrets Detection
Secrets Detection
See Nullify in Action
Nullify confirms which leaked secrets are live, so your team rotates the dangerous ones first.