SecOps

Secret Scanning

Secret scanning uses a combination of regex patterns and Shannon entropy analysis to detect exposed credentials in source code, configuration files, and documentation. The pattern library covers 40+ service-specific formats including AWS access keys, GitHub tokens, Stripe API keys, and database connection strings. Custom patterns can be added per workspace.

Scanning runs via the Transit Agent (for repository scanning) or the Scan Agent (for CI/CD pipeline integration). Findings are deduplicated by fingerprint and linked to CoreLink vault entries when a match exists.

Secret Scanning screenshot

Key Configuration

  • Pattern library selection (built-in + custom)
  • Entropy threshold for generic detection
  • Scan scope (repositories, directories, CI pipelines)
  • Finding severity classification rules
All documentation Question about this? Talk to us