Secret scanning

What it means

Secret scanning is the automated search of code, commit history and other text for credentials that should never be stored there: API keys, passwords, private keys and access tokens. Scanners match known formats, such as the prefix a cloud provider puts on its keys, and often look for high-randomness strings too.

The important detail is history. Deleting a key from the latest version of a file does not remove it from earlier commits, forks or clones. A scanner that reads only the current files will miss a secret that anyone with repository access can still retrieve.

Why it matters

A leaked key is often the shortest route into a business. It needs no exploit and no clever chain, only a copy. Automated tools crawl public repositories looking for keys, so a secret pushed by mistake can be found and used quickly. Speed matters more than elegance here.

Cost follows the key's power. A read-only analytics token is an annoyance. A cloud admin key can mean data exfiltration, a surprise bill and a breach notification. Finding it first, and rotating it, is cheap by comparison. It extends the idea of a hardcoded secret to the whole history.

How it shows up

You meet it in three places: a pre-commit hook on the developer's machine, a check on each pull request, and a scheduled scan of whole repositories including old branches. Good setups also scan chat exports, build logs, container images and tickets, because secrets leak well beyond source files.

The common mistakes are treating a found secret as fixed once the line is deleted, and skipping the rotation. A secret that has been exposed is compromised. Revoke it, issue a new one through your secrets manager, and check the logs for use of the old value.