Secrets Scanning: Preventing Credential Leaks in Code and Config
How secrets scanning detects exposed API keys, passwords, and credentials in code repositories and configuration files.
AWS keys in a GitHub repo. Database passwords in a config file. API tokens hardcoded in application code. Exposed secrets are one of the most common — and most preventable — causes of data breaches. Secrets scanning automatically detects credentials that shouldn't be in your code or configuration files.
What Secrets Scanning Detects
Modern secrets scanners look for patterns matching: AWS access keys and secret keys, Azure connection strings and service principal credentials, Google Cloud API keys, Stripe/PayPal/payment API keys, Database connection strings with embedded passwords, SSH private keys, OAuth tokens, JWT secrets, Generic passwords in configuration files, and API endpoints with embedded authentication.
Where to Scan
Git Repositories: Scan every commit, branch, and pull request. Check the full git history, not just the current HEAD — a secret committed and then "deleted" in a later commit is still in the git history and accessible to anyone with repo access.
Configuration Files: Scan config files on servers and endpoints. web.config, .env files, application.yml, docker-compose files, and Kubernetes manifests often contain embedded credentials.
CI/CD Pipelines: Build scripts and deployment configurations may contain hardcoded credentials or log them in build output.
Response When Secrets Are Found
1. Revoke immediately. The moment a secret is detected as exposed, assume it's been compromised and revoke it. Generate new credentials.
2. Audit usage. Check if the exposed credential was used maliciously. Review access logs for the affected service.
3. Remove from code. Replace hardcoded secrets with environment variables, secrets managers (Azure Key Vault, AWS Secrets Manager, HashiCorp Vault), or your platform's built-in secret management.
4. Prevent recurrence. Configure pre-commit hooks that block commits containing detected secrets. Add secrets scanning to your CI/CD pipeline as a required check.
For MSPs
Secrets scanning is particularly relevant for MSPs who manage client cloud infrastructure and development environments. When your tech inadvertently commits a client's AWS key to a shared repo, the consequences can be catastrophic — crypto mining charges, data exfiltration, or complete environment compromise. Automated scanning prevents these incidents from ever reaching production.