Secrets category
Rule IDs such as S003 JWT Secret Hardcoded, S004 Database URL Exposed, S007 Private Key in Code.
Tools · Secret detection
Catch hardcoded secrets before they ship.
Deterministic secret rules look for JWT secrets, database URLs, private key blocks, Stripe key construction patterns, and related credential leaks in the code you submit.
What this check covers
Checklist CL01
No API keys hardcoded — tied to secret rule IDs.
Python too
Python hardcoded secret patterns are included in the shared engine where applicable.
Example signal
[SIGNAL] CRITICAL — JWT Secret Hardcoded (S003) [SIGNAL] CRITICAL — Database URL Exposed (S004) fix: Move secrets to environment storage / secrets manager
In scope
- Regex/heuristic detection on provided source
- Severity and fix guidance in findings
- Re-test after you remove or relocate secrets
Limitations
- Not a live cloud secret-manager audit
- Obfuscated or vault-fetched secrets may not match
- Finding a pattern is not proof of active exploitation
Local result
Recorded result
Verified evidence
FAQ
Do you upload my secrets to train models?
Product policy is not to retain full raw source on scan-metadata paths. Prefer local checks when you need maximum isolation.
Is this enough for SOC 2?
Secret detection is one control input. Continuous evidence and human review still apply — see framework landers.