Skip to main content

​
Overview

Cysmiq detects leaked credentials, API keys, tokens, and other secrets in source code. Each finding identifies whether Cysmiq used a provider check or a context assessment.

​
What scans detect

Secrets scanning identifies patterns for:
  • Cloud provider credentials (AWS, GCP, Azure)
  • API keys and tokens (GitHub, Stripe, Twilio, OpenAI, etc.)
  • Database connection strings
  • Private keys and certificates
  • Webhook URLs with embedded secrets

​
Coverage

Secrets scanning is file-type agnostic.
  • Provider checks: Scan all file types and languages, except specific lock files such as yarn.lock and package-lock.json.
  • Context assessments: Use default ignore rules for vendored and test files, plus common generated assets such as node_modules, vendor, tests, and minified files.

​
Assessment methods

Detected secrets use one of two assessment methods:
  • Provider check: For supported providers, Cysmiq makes API requests to determine whether the credential is valid and active. See Secret verification providers for the full list.
  • Context assessment: When a provider check is unavailable, Cysmiq reviews the detection and its source context to help determine whether it is actionable or needs further investigation.

​
Provider check status

​
Git history scanning

Git history scanning searches the full commit history for secrets that may have been committed and later removed. Even if a secret is no longer in the current codebase, it may still be active and exposed in the repository history. Git history scanning runs as a separate scan that searches the full commit history.
Availability depends on your Cysmiq plan.