Secret Scanning
Detect exposed API keys, tokens, and credentials across code, Git history, and CI logs.
OpenHack checks the places where credentials are commonly exposed: current source code, earlier Git revisions, and CI logs. Each finding identifies what was detected and where it appeared so the owner can investigate it directly.
Secret scanning is part of the repository security workflow. Findings can be reviewed alongside code and dependency issues instead of being managed as a separate set of alerts.
How it works
- 01
Scan connected sources
Inspect source files, Git history, and available CI logs for credential material.
- 02
Identify secret candidates
Detect API keys, access tokens, credentials, and other values that should not be stored in these sources.
- 03
Attach location context
Show the repository, file, commit, or log location connected to the finding.
- 04
Route remediation
Give the team the context needed to remove the exposed value, rotate it where necessary, and track the finding.
What it covers
Source code
Check current repository content for credentials committed in configuration, application code, scripts, or documentation.
Git history
Inspect earlier revisions because removing a secret from the latest file does not remove it from repository history.
CI logs
Check available build and deployment output for values that were printed during automation.
Common credential types
Look for API keys, access tokens, passwords, and other authentication material that should be stored securely.
What you get
- The detected credential type
- Repository, file, commit, or log location
- Context for investigation and ownership
- Removal and credential-rotation guidance
Get started
Connect repositories to include secret scanning in the same managed workflow as codebase and dependency scanning.