Secrets scanning
Find passwords, API keys and tokens accidentally committed to code.
Overview
The Secrets engine scans your repository for credentials that should never live in source control — cloud keys, database passwords, API tokens and private keys.
Leaked secrets are one of the most common causes of breaches: anyone with repo access (or git history) can extract and abuse them.
How it works
SecNxt matches 30+ provider-specific credential formats (AWS, GitHub, Stripe, Google and more), then adds entropy checks for generic high-randomness values.
Provider-format matches are auto-verified; ambiguous matches are reviewed by AI to keep false positives low.
How to use it
- 1Open a project and choose Secrets.
- 2Connect a repository (public URL or your GitHub account for private repos).
- 3Pick a scan depth and run the scan.
- 4Rotate any exposed secret immediately and move it to a secret manager.
When to use it
- Catching keys before they reach a public repo.
- Auditing an inherited codebase for committed credentials.
Tips & best practices
- Rotate first, then remove from git history — deletion alone doesn't undo exposure.
FAQ
- Do you store the secret value?
- No — evidence is redacted before it is saved.