Secrets detection is the automated process of scanning code, configuration files, logs, and model outputs for accidentally exposed credentials — such as API keys, passwords, database connection strings, private keys, and access tokens. In AI applications, secrets detection is especially important because LLMs may inadvertently generate or reveal sensitive credentials.

What Counts as a Secret

• API Keys: OpenAI, AWS, Azure, Google Cloud, Stripe, Twilio keys
• Passwords: Database passwords, admin credentials
• Connection Strings: Database URLs with embedded credentials
• Private Keys: SSH keys, SSL/TLS certificates, JWT signing keys
• Tokens: OAuth tokens, session tokens, bearer tokens
• Webhooks: URLs with embedded authentication tokens

Detection in Code

• Pre-Commit Hooks: Tools like git-secrets and pre-commit scan staged changes and block commits containing secrets.
• CI/CD Scanning: truffleHog, GitLeaks, and detect-secrets scan the entire repository (including git history) for exposed secrets.
• Platform Scanning: GitHub Advanced Security, GitLab Secret Detection, and Bitbucket Secret Scanning automatically scan repos for known key patterns.

Detection in AI Outputs

• LLM Output Screening: Scan model responses for patterns matching known credential formats before displaying to users or logging.
• Training Data Audit: Check training data for accidentally included secrets that the model might memorize and reproduce.
• RAG Document Screening: Scan documents in the retrieval corpus for credentials that could be surfaced through RAG queries.

Response to Detection

• Immediately Revoke: Rotate or revoke any exposed credential as soon as it's detected.
• Assess Impact: Determine if the secret was publicly accessible and for how long.
• Audit Usage: Check access logs for unauthorized use of the compromised credential.
• Root Cause: Fix the process that allowed the secret to be exposed.

Secrets detection is a critical security automation — most major data breaches involve compromised credentials, and automated detection prevents the most common exposure vectors.