Skip to main content
Infisical Secrets Scanning detects credentials that have been placed in locations where they shouldn’t be stored, such as source code repositories, configuration files, and helper scripts. Scanning can be performed against connected cloud-hosted repositories or against local files on a developer’s machine.

Secrets Scanning docs

Data sources, scan modes, findings and lifecycle, custom rules, and CLI usage.

​
Use cases

Monitor connected repositories

Continuously scan GitHub, GitLab, and Bitbucket repositories as new commits are added.

Scan locally with the CLI

Scan a working directory, Git history, or staged changes before they’re pushed to a shared branch.

Manage findings across scans

Review detected credentials with file, line, commit, and rule; resolve, ignore, or mark them as false positives.

​
What is a leaked secret?

A leaked secret is a credential that has been stored or exposed in a location where it can be accessed by users who aren’t authorized to use it. Common examples include public source code repositories, private repositories with a large set of readers, shared configuration files, and build logs. A credential that has been leaked can be used by anyone who can read it until the credential is rotated or revoked.

​
Why scan for leaked secrets

Secrets are often leaked unintentionally. Common examples include committing a .env file to a repository, printing environment variables to a CI log, and pushing a script that contains credentials to a shared branch. These events don’t require any intent to expose the credential, and they will continue to occur unless there is an automated process to detect them. Secrets scanning provides this automated process. Continuous scanning of connected repositories detects credentials as new commits are added, and local scanning before a push prevents credentials from being pushed at all. Together, these two approaches reduce the time between when a credential is leaked and when it’s detected.

​
How Infisical does it

Infisical Secrets Scanning runs in two environments.
  • Connected repositories. GitHub, GitLab, and Bitbucket repositories can be monitored continuously. Each new commit is scanned. When a credential is detected, Infisical records a finding that includes the file path, line number, commit hash, and the detection rule that matched.
  • Local environments. The infisical scan CLI command scans a working directory, Git history, or staged changes in a CI pipeline before the changes are pushed to a shared branch.
The detection engine uses pattern matching, entropy analysis, and user-defined rules to identify credentials. Findings can be resolved, ignored, or marked as false positives, and each scan is recorded in an audit log. To reduce the number of false positives, users can define custom detection patterns, ignore rules through infisical-scan:ignore and .infisicalignore, adjust the entropy threshold, and exclude specific file paths from scanning.