// tool reference · Vulnerability & Assessment
Secret Scanner Free
Find hardcoded credentials, API keys and tokens in a blob of text or code.
What it does
Finds hardcoded credentials, API keys, tokens and private keys in code or config before they reach a repository.
When to use it
- Pre-commit review; auditing an inherited codebase; checking a config before sharing it.
Inputs
Field names are the actual form parameters, verified against source.
| Field | Type | Required | Notes |
|---|---|---|---|
| blob | textarea | required | Code or configuration. |
What you get back
Detected secrets by type and location, with remediation.
Worked example
Input
DB_PASSWORD=hunter2 aws_key = "AKIAIOSFODNN7EXAMPLE" const stripe = 'sk_live_51H8xY2eZvKYlo2C...' -----BEGIN RSA PRIVATE KEY-----
Output (abridged)
4 SECRETS FOUND -- treat ALL as COMPROMISED
CRITICAL Stripe live key sk_live_51H8xY2... line 3
Live key. Charges real money. Rotate first.
CRITICAL RSA private key line 4
A private key in a file that can be copied is not private.
HIGH AWS access key ID AKIAIOSFODNN7EXAMPLE line 2
HIGH Database password line 1
ROTATE, do not delete. Removing the line does not un-leak the value --
if this was ever committed it is in git history, in every clone, and
possibly in a CI log. The value is burned the moment it exists in
plaintext somewhere you did not intend.
ORDER: Stripe -> RSA -> AWS -> DB.
How it works
Deterministic pattern matching against known credential formats. Offline — your code is not transmitted.
Limits
Read live from the platform configuration.
| Rate limit | 30 requests / 60s (platform default) |
Limitations — what it does not do
Pattern-based, so it finds known credential FORMATS. A bespoke token with no distinctive shape will be missed. Clean output means 'no recognised patterns', not 'no secrets'.
Privacy
Analysed in memory. Not stored. If a real secret is found, rotate it — detection means it existed in plaintext.
Standards
CWE-798 Hardcoded CredentialsOWASP Top 10