.
Capability

Secrets Detection

Nullify's secrets detection finds exposed credentials in your code, then verifies which ones are actually live. Pattern matching and NLP surface API keys, tokens, and hardcoded PII across your codebase; each candidate is checked against the real provider — AWS, GCP, Azure, GitHub, GitLab, Stripe, Slack — so you know which secrets need rotating now.

What it does

  • Finds secrets two ways. Pattern matching catches structured credentials with a known format; NLP catches free-form secrets that don't follow one — together they cover ground a pure regex scanner misses.
  • Verifies which ones are actually live. Every candidate secret is tested by attempting to authenticate with it against the real provider — AWS, GCP, Azure, GitHub, GitLab, Stripe, Slack. A credential that successfully authenticates is confirmed as an active exposure, not just a pattern match.
  • Tells you who to page. Each finding carries a suspected owner and rotation guidance, so the person who can actually rotate the credential is pointed at it directly.
  • Prioritizes what matters. Findings are sorted into 5 categories, including PII, and live secrets are prioritized ahead of dead or already-rotated ones.

How it works

Nullify scans your code for secrets using both pattern matching and NLP, so it catches structured credentials with a known format as well as free-form ones that aren't. Every candidate is then verified: Nullify attempts to authenticate with the discovered credential against the real provider — AWS, GCP, Azure, GitHub, GitLab, Stripe or Slack — rather than assuming a pattern match is a live secret. A credential that successfully authenticates is confirmed live and prioritized as an active exposure; each finding is also enriched with a suspected owner and rotation guidance, so the response is a rotation, not just an alert.

Frequently asked questions

How is this different from a regex-based secrets scanner?+

Most secrets scanners stop at pattern matching, which means every finding still needs a human to check whether the credential actually works. Nullify goes a step further: after pattern matching and NLP find a candidate, Nullify attempts to authenticate with it against the real provider — AWS, GCP, Azure, GitHub, GitLab, Stripe, Slack. A confirmed-live secret is treated as an active exposure and prioritized; a dead or already-rotated key is still reported, just not paged as urgent.

What happens after a live secret is found?+

The finding is tagged with a suspected owner and rotation guidance, so the person who can actually rotate the credential is pointed at it directly instead of the whole team getting a generic alert. Live secrets are prioritized ahead of everything else in the queue.

Does Nullify rotate the credential for us?+

No — rotating a live credential is a provider-side action Nullify doesn't have standing access to perform. Nullify finds the secret, confirms whether it's live, identifies a suspected owner, and provides rotation guidance; a human completes the rotation.

What kinds of secrets does it catch?+

Findings are sorted into 5 categories, including PII — so hardcoded personal data gets flagged alongside API keys, tokens and other credentials. The full category breakdown is in the docs.

Read the docs: Secrets Detection · Supported Secret Categories · Related: Code Security · Cloud Security · Triage & Remediation

Stop Guessing Which Secrets Are Live

Book a demo and watch Nullify find a secret in your own code and tell you, in real time, whether it's still active.

Book a Demo