SECRETS DETECTION & SECRET SCANNING
The secrets detection tool that catches the key before production.
Mapnostics runs secret scanning across every file in your repository — hardcoded API keys, tokens, passwords, connection strings, and committed .env or private-key files. More than fifty detection patterns, each finding ranked by severity with its code context, every value masked.
Key features of secret scanning
Severity you can triage
Critical, high and medium, each with a 'why this matters' explanation and a recommended fix — so the noisy findings do not bury the dangerous one.
Code context on every finding
The exact line, the file, and the surrounding code — not just a file name and a guess. Values are masked to their first six characters.
Findings that persist
Mark a credential rotated and the status survives every rescan; once the code no longer contains the secret, the finding clears on its own.
Feeds the Health Score
Secrets exposure is weighted by severity and capped at 15 points, so a rotated credential moves the number.
How secret scanning prevents credential exposure
01
Every file, plus the file tree
The scan reads every indexed file in the repository and walks the full GitHub file tree, so a committed .env or .pem file is caught even though it is never indexed as code.
02
More than fifty patterns, fewer false positives
Provider-specific patterns that know what a Stripe live key or an AWS access key looks like, alongside structural ones for connection strings, private key blocks and high-entropy values. Documented example keys and placeholders are suppressed.
03
Ranked, masked, persistent
Each finding gets a severity set by the pattern that matched, a masked value, and the code context — and keeps its status across rescans until the code itself is clean.
Supported keys, tokens & credentials
Provider-specific patterns are confident where a generic “looks like a key” rule can only guess. The scanner currently covers, among others:
Mapnostics next to a dedicated secret scanner
Mapnostics is a codebase intelligence platform, and secret scanning is one part of the same scan that maps dead code, dependencies and change impact. Dedicated secrets detection tools go further on a few jobs. Here is the honest split.
Use Mapnostics for
Auditing the code as it stands
Every indexed file and the full file tree, so a committed .env, .pem or .key file is caught as well as a key pasted into source.
Triage, not just a list
Severity, the code context and a masked value on every finding, with a status that survives each rescan.
One view of repository risk
Secrets exposure feeds the same Health Score as dead code and key-person risk, from the same scan.
Add a dedicated scanner for
Git history
Mapnostics scans the code at its last index. A secret a later commit removed is still in history; Gitleaks and TruffleHog scan every commit.
Blocking a leak before the push
A pre-commit hook or GitHub push protection stops a key before it reaches the remote. Mapnostics reports once it is in the repository.
Checking a key is still live
Some scanners call the provider to verify a found credential. Mapnostics does not; severity comes from the pattern that matched.
Running both is normal: a pre-commit hook to stop new leaks, and Mapnostics to audit what is already there — useful when you inherit a repository or review one for technical due diligence.
Scan for exposed secrets in under 2 minutes.
Analyze my codebase →No credit card required · Free tier available
Common questions
What does the secrets detection tool detect?
More than fifty patterns: provider keys (AWS, GitHub, Stripe, OpenAI, Anthropic, Google, Slack, Twilio and more), database connection strings, private key blocks, JWT secrets, hardcoded passwords and high-entropy values — plus sensitive files such as .pem, .key and .env committed to the repository.
How does secret scanning work?
Pattern matching over every indexed file and the full repository file tree, with no AI call involved. Documented example keys and obvious placeholders are suppressed, and name-based checks stand down inside test files, so the findings list stays actionable.
Does Mapnostics store the secrets it finds?
Findings show a masked value — the first six characters — with the file, the line and the surrounding code context. Indexed code content is encrypted at rest with AES-256-GCM.
How is this different from GitHub's own secret scanning?
GitHub's secret scanning watches commits as they land, and push protection can block a known key before it reaches the repository. Mapnostics audits the code as it stands, in the same scan that maps dead code and dependencies, and gives every finding a severity, its code context and a status that survives rescans. It does not block a push, so the two work well together.
Does the secrets detection tool scan git history?
No. It scans every indexed file and the full file tree at the repository's last index. A secret that a later commit removed is still in git history, so pair Mapnostics with a history scanner such as Gitleaks or TruffleHog, and rotate any key that was ever committed.
Do findings survive a rescan?
Yes. A finding keeps its status across scans, so a credential you marked rotated stays marked. When the code no longer contains the secret, the finding clears on the next scan automatically.