Skip to main content

​
Overview

Cysmiq detects leaked credentials, API keys, tokens, and other secrets in source code. Each finding identifies whether Cysmiq used a provider check or a context assessment.

​
What scans detect

Secrets scanning identifies patterns for:
  • Cloud provider credentials (AWS, GCP, Azure)
  • API keys and tokens (GitHub, Stripe, Twilio, OpenAI, etc.)
  • Database connection strings
  • Private keys and certificates
  • Webhook URLs with embedded secrets

​
Coverage

Secrets scanning is file-type agnostic.
  • Provider checks: Scan all file types and languages, except specific lock files such as yarn.lock and package-lock.json.
  • Context assessments: Use default ignore rules for vendored and test files, plus common generated assets such as node_modules, vendor, tests, and minified files.

​
Assessment methods

Detected secrets use one of two assessment methods:
  • Provider check: For supported providers, Cysmiq makes API requests to determine whether the credential is valid and active. See Secret verification providers for the full list.
  • Context assessment: When a provider check is unavailable, Cysmiq reviews the detection and its source context to help determine whether it is actionable or needs further investigation.

​
Verification history

The Verification History section on a secret’s detail page shows results for individual provider checks. Cysmiq retries temporary provider failures while automated verification is enabled and retry attempts remain available. Providers that support credential suspension also receive scheduled rechecks when eligible. Verification results are retained for 30 days. An empty history can mean that no check has been recorded or that earlier results have expired. Review the current secret status and verification timestamps alongside the history.

​
Removed secret locations

Full scans mark secret locations as fixed when the secret is absent from the scanned repository coverage. For credentials assessed by a Provider check, removing every code location keeps the finding open for provider verification. Revoke or rotate the credential to address its continued validity.

​
Git history scanning

Git history scanning searches the full commit history for secrets that may have been committed and later removed. Even if a secret is no longer in the current codebase, it may still be active and exposed in the repository history. Git history scanning runs as a separate scan that searches the full commit history.
Availability depends on your Cysmiq plan.