Secret Scanning

Anyone who writes software often needs credentials: a password for a database, a long key for a third-party service. In technical language, such credentials are called secrets. They should never really end up directly in the text files that make up a program. Yet that’s exactly what happens all the time, because it’s faster during development. Secret scanning is the automated search for such accidentally stored secrets. A program scans through all the files of a project and sounds the alarm when a string looks like an access key.

Why it matters

The program code of many projects is publicly available on the internet, for example on the platform GitHub. Anyone who publishes a real access key there is effectively handing strangers a house key. Attackers search for such finds automatically, around the clock. The time between publication and first misuse is often measured in minutes.

The damage can be considerable. With a stolen key for a cloud provider, someone can rent servers whose bill lands with the victim. A database password opens access to customer data. Several major security incidents in recent years started exactly this way: not with a sophisticated hack, but with a password someone forgot to remove.

A second problem makes matters worse. Developers usually work with version control that permanently retains every old version of the code. Simply deleting a password is therefore not enough. It remains in the history and stays discoverable. A discovered secret must always be replaced, not just removed.

How it works

The basic idea is pattern recognition. Many access keys have a fixed format, such as a specific prefix at the beginning and a fixed length. A scanner knows hundreds of such formats and finds them reliably. This is similar to searching for IBANs in a text document: the structure is so distinctive that matches are hardly coincidental.

Secrets without a fixed pattern are harder to detect, for example a self-chosen password. Here additional signals help. The scanner watches for variable names like “password” or “token”. It also measures how random a string appears. A wild jumble of letters and digits is more likely to be a key than a normal word.

Some providers go a step further and actively check whether a find is valid. The scanner queries the associated service to see whether the key works. This distinguishes real emergencies from harmless sample data. Large platforms even notify the affected service directly so it can revoke the key.

The check is most effective before the code is even uploaded. Such checks run automatically with every change and block it if in doubt. Then the problem never arises in the first place.

Where you encounter the term

GitHub, GitLab, and similar platforms have secret scanning built in, usually free for public projects. There are also well-known free tools like TruffleHog or Gitleaks. They appear in many job postings for security roles.

In business news, you read the term when a data breach is being investigated. The analysis often states that an access key was sitting in a public repository. The topic is also increasingly mentioned in connection with AI: coding assistants that suggest code have learned from huge code collections and occasionally reproduce real keys. This increases the pressure to consistently keep secrets out of the code.