Secrets Scanning
Regex catches the obvious. LLMs catch what regex misses. Every confirmed key becomes an attack path the whitebox pentest exploits.
Every secret type, every commit
GitHub tokens
GitHub
Personal access tokens, OAuth tokens, GitHub App credentials.
Vendor API keys
Third-party
Stripe, Slack webhooks, bot tokens, and other third-party vendor keys.
Generic high-entropy strings
Entropy
Base64 and hex-encoded secrets flagged by entropy analysis when they don't match any known pattern.
Bearer tokens in URLs
URLs
Credentials embedded in URL query parameters or fragments. Easy to leak through logs and referrer headers.
Environment variable secrets
Config
Secrets set via ENV in Dockerfiles, docker-compose files, and config files in the repository.
Encoded payloads
Encoded
Secrets buried inside base64 blobs, JWT payloads, or hex-encoded config strings.
Webhook signing secrets
Webhooks
HMAC signing keys for inbound webhooks, often hardcoded in handlers and CI scripts.
JWT signing secrets
Auth
HS256 secrets and RS256 private keys used to sign session tokens, leaked in test files and configs.
Beyond the obvious credential classes, the scanner catches the long tail: tokens in URLs, environment indirection, and high-entropy strings that don't match any known signature. Each confirmed secret hands the pentest one more credential to try.
The secrets regex-only tools miss aren't hiding. They're obfuscated.
Credentials constructed by string concatenation, passed through environment indirection, or buried in serialized data. Our two-tier scanner detects them, validates each candidate against the surrounding code, and classifies every confirmed secret by type, scope, and blast radius.
Two-tier pipeline
Tier 1 pattern matching flags known secret formats in milliseconds. Tier 2 LLM validation evaluates each candidate in context and catches the obfuscated exposures regex misses. Every confirmed finding is classified by type, scope, and blast radius before it reaches your queue and the pentest that tries to exploit it.
Regex patterns
01 · Tier 1
Pattern matching sweeps the working tree and commit history for known secret formats: configs, environment files, scripts, CI/CD pipelines, and application source.
LLM validation
02 · Tier 2
Every candidate is evaluated by an LLM against the actual code. Is this a real credential, or a placeholder, test fixture, or documentation example? The model also catches non-obvious exposures that pure regex misses.
Type, scope, blast radius
03 · Classify
Every confirmed secret is tagged by type, scope, and blast radius. You see what the credential unlocks before you triage it.
Severity classification
AWS keys and private keys are Critical. API keys are High. Findings are auto-classified by blast radius: what the credential can reach, and what its compromise would impact.
Critical
Cloud credentials, private keys
Rated Critical because their scope is broadest.
High
Database credentials, API keys
They follow the Critical tier, rated High.
Blast radius
Proven by the pentest
The whitebox pentest chains each confirmed credential to the systems it can reach.
Blast radius is exactly what the whitebox pentest sets out to prove. See classification rubric →
Verified. Deduplicated. Low false positive rate.
Every scan ends with a verification phase: each finding is confirmed against the surrounding code, findings from test files, fixtures, and example documentation are filtered out, and overlapping issues are deduplicated. The result is a report you can actually act on.
For secrets specifically, the LLM re-reads every candidate where it sits in the code before it counts.
Every candidate, in its own code
Confirm
Each finding is evaluated against the actual code before it lands in your queue.
Tests, fixtures, docs dropped
Filter
Findings from test files, fixtures, and documentation examples are filtered out automatically.
One actionable item
Deduplicate
Overlapping findings collapse into a single actionable item, so you triage once instead of three times.
Mark it once, never re-triage it
False positive tagging
Mark a finding as a false positive once and Keygraph carries that dismissal forward on every subsequent scan. Dismissed issues stop showing up.
One pipeline, the whole surface
Secrets Scanning is one module on the Keygraph platform. Everything below shares the same findings model, deduplication, and reporting.
Pentesting
Whitebox PentesterCode-aware exploit validation Blackbox PentesterNo source access required Business Logic TestingAbuse of intended behaviour ShannonThe open-source engineSee it find your leaked keys
Schedule a demo and watch Secrets Scanning run against a real repo.