Secrets Detection

Mapnostics scans your entire repository for hardcoded credentials, API keys, tokens, and private data — before they reach production and before they become a breach notification.

How it works

The scanner uses pattern matching for known secret formats (AWS keys, JWT tokens, private keys) combined with AI-assisted context analysis for semantic secrets — strings that look like passwords even without a known pattern.

• API keys and tokens — AWS, Stripe, SendGrid, GitHub, OpenAI, and 40+ providers.
• Database connection strings — Postgres, MySQL, MongoDB URIs with embedded credentials.
• Hardcoded passwords — including variables named password, secret, or key.
• Private IPs and internal hostnames — often left from development environments.

Live demo

The scanner reports progress as a percentage bar. Once complete, findings surface by severity — each showing the file, line number, raw snippet, and a masked version for safe sharing.

Severity levels

High

Active credentials for cloud services, payment providers, or authentication systems. Rotate immediately — assume compromised if they appear in any commit history.

Medium

Hardcoded passwords for non-production environments or internal API keys. Still a risk, especially if the same password is reused in production.

Low

Private IP addresses, internal hostnames, and development-only tokens. Lower urgency but should be removed to avoid leaking infrastructure topology.

How to respond

• 1. Rotate the credential immediately — do not wait until the code is fixed.
• 2. Check provider logs for unauthorized access during the exposure window.
• 3. Remove the hardcoded value and replace with an environment variable.
• 4. Purge from git history using BFG or git filter-repo.
• 5. Mark the finding as resolved in Mapnostics to track remediation.