Secret Scanner

Software often needs credentials to communicate with other services. These are, for example, passwords, digital keys, or long strings of characters that a program uses to identify itself to a provider. Such credentials are called “secrets” in English. They actually belong in a protected storage location, but very often end up directly in the written source code. A secret scanner is a tool that searches for exactly that: it combs through files and reports every spot where such a secret is lying around in plain sight.

Why a forgotten key becomes expensive

An exposed access key is like a front door key left sticking in the lock from the outside. Whoever finds it can use it immediately. It becomes especially delicate when the source code is publicly available on the internet, for example on platforms like GitHub. There, automated programs search around the clock for exactly such findings.

How quickly this happens surprises many. Studies show that published cloud keys are often tried out within just a few minutes. Attackers then use them to launch expensive computing jobs, usually for mining cryptocurrency. The bill goes to the owner of the account and can reach five-figure sums.

On top of that, there is a second problem. Source code is usually stored in a version control system that permanently archives every change. If you later simply delete the key, it still remains in the history. A secret scanner finds such legacy remnants and makes clear that the affected key must be replaced.

Patterns, checksums, and false alarms

The simplest method works with fixed search patterns. Many providers give their keys a recognizable format, such as a fixed prefix and a certain length. The scanner knows hundreds of such patterns and reports every match. In addition, it checks whether a found string is mathematically consistent, since many keys contain a built-in checksum digit.

Secrets without a fixed format are more difficult, for example a self-chosen database password. Here a statistical measurement helps: a randomly generated string appears much more disordered than a normal word. Experts speak of high entropy. Newer tools additionally let a language model read along, which evaluates the context and distinguishes test data from real keys.

Every scanner faces a trade-off here. If it searches too strictly, it constantly reports harmless sample data, and the team eventually starts ignoring the warnings. If it searches too loosely, a real key slips through. Good tools therefore check with the respective provider whether a found key is even still valid.

From the developer’s laptop to the headlines

In the everyday life of software companies, secret scanners run in two places. First, directly on the developer’s machine, shortly before a change is submitted. Second, on the server that automatically checks every incoming change. If it finds something, the change is blocked until the secret is removed.

GitHub operates such a scanner for all public projects free of charge and directly informs the affected provider upon a finding. The provider can then revoke the key, often before any damage occurs. There are also free tools like Gitleaks or TruffleHog and commercial providers like GitGuardian.

In the news, this topic usually comes up after a data breach. Very often the entry point was not a sophisticated attack, but a forgotten key in an old project. With the rise of AI coding assistants, the risk has if anything increased, since these systems generate very large amounts of source code very quickly. A secret scanner does not replace a secure password store; it is the safety net underneath it.