secrets detection

**Secrets detection** is the automated process of scanning code, configuration files, logs, and model outputs for **accidentally exposed credentials** — such as API keys, passwords, database connection strings, private keys, and access tokens. In AI applications, secrets detection is especially important because LLMs may inadvertently generate or reveal sensitive credentials. **What Counts as a Secret** - **API Keys**: OpenAI, AWS, Azure, Google Cloud, Stripe, Twilio keys - **Passwords**: Database passwords, admin credentials - **Connection Strings**: Database URLs with embedded credentials - **Private Keys**: SSH keys, SSL/TLS certificates, JWT signing keys - **Tokens**: OAuth tokens, session tokens, bearer tokens - **Webhooks**: URLs with embedded authentication tokens **Detection in Code** - **Pre-Commit Hooks**: Tools like **git-secrets** and **pre-commit** scan staged changes and block commits containing secrets. - **CI/CD Scanning**: **truffleHog**, **GitLeaks**, and **detect-secrets** scan the entire repository (including git history) for exposed secrets. - **Platform Scanning**: **GitHub Advanced Security**, **GitLab Secret Detection**, and **Bitbucket** Secret Scanning automatically scan repos for known key patterns. **Detection in AI Outputs** - **LLM Output Screening**: Scan model responses for patterns matching known credential formats before displaying to users or logging. - **Training Data Audit**: Check training data for accidentally included secrets that the model might memorize and reproduce. - **RAG Document Screening**: Scan documents in the retrieval corpus for credentials that could be surfaced through RAG queries. **Response to Detection** - **Immediately Revoke**: Rotate or revoke any exposed credential as soon as it's detected. - **Assess Impact**: Determine if the secret was publicly accessible and for how long. - **Audit Usage**: Check access logs for unauthorized use of the compromised credential. - **Root Cause**: Fix the process that allowed the secret to be exposed. Secrets detection is a **critical security automation** — most major data breaches involve compromised credentials, and automated detection prevents the most common exposure vectors.