Secrets Detection

Path: /code/secrets · Sidebar: Testing → Code Security → Secrets

Secrets detection finds API keys, tokens, passwords and private keys committed to your repositories - including ones hiding in history.

What it detects

• Hardcoded credentials - API keys, cloud keys, DB passwords, private keys, webhook tokens.
• Git history - secrets in past commits, not only the current tree.
• Validity checks - where possible, whether a detected secret is still live (active) versus already revoked, so you fix real exposure first.

Run a secrets scan

1. From Repositories, scan a repo.
2. apPosture scans the working tree and commit history.
3. Findings appear here and in Vulnerabilities.

Reading a secrets finding

• Secret type, file + commit, and where in history it appeared.
• Validity signal (live / unknown / revoked).
• Remediation: rotate the secret first, then purge it from history.

Rotation beats deletion

Deleting a secret from code does not make it safe - it may still be in history and already compromised. Always rotate/revoke the credential, then clean history.