Secret detection

vulnetix secrets looks for hard-coded credentials: cloud keys, source-control and CI tokens, AI provider keys, payment keys, database connection strings with passwords, private keys, webhook URLs and about 400 SaaS API tokens. It runs the 1,092 built-in Rego rules of kind secrets over your working tree, the printable strings inside binary files, image metadata, decoded Kubernetes Secret values and the files changed in your recent git history. It runs on your machine. Credentials are optional.

The command is the secrets stage of vulnetix scan on its own. These two run the same rules:

vulnetix secrets
vulnetix scan --only secrets

vulnetix secrets locks the rule set to kind secrets: SAST, IaC, container, SCA and licence analysis do not run, and an external pack passed with --rule contributes only its rules of kind secrets.

What a run does

1. Walks --path (default .) to --depth (default 3) levels, skipping .git, node_modules, vendor, .venv, .tox, __pycache__, .cargo, .hg, .vulnetix, anything matched by --exclude or --ignore, and anything your .gitignore files match.
2. Loads each text file up to 1 MiB. A binary file is reduced to its printable strings, and an image’s EXIF, IPTC and XMP metadata is read out. The data: values of Kubernetes Secret documents are base64-decoded.
3. Reads up to 500 commits of git history, newest first, and adds up to 5,000 past file versions of up to 4 MiB each.
4. Evaluates the rules. Each rule checks for a keyword or prefix first, extracts the token with a regular expression, drops documented example and placeholder values, and for most rules requires a minimum Shannon entropy.
5. Prints the report grouped by credential, writes .vulnetix/sast.sarif and .vulnetix/memory.yaml, and exits 1 if a --fail-on gate is breached.
6. When you are authenticated, submits the findings to Vulnetix and prints a snapshot link.

What gets scanned has the detail and the known blind spots.

What leaves your machine

Nothing, unless you are authenticated. When you are, the CLI posts one SARIF submission to /v2/cli.secrets with each finding’s rule, file, line and a code snippet. The snippet is read from the file with three to five lines of context on each side, so it holds the credential line as written. Pass --snippet-context 0 to send only the rule’s own snippet, which most rules mask. Output and exit codes lists the rules that do not mask.

Find the page for your task

I want to	Read
Run my first scan and gate CI on it	Quickstart
Know whether binaries, history or .env files are covered	What gets scanned
Read the ROTATE NOW, NOT COMMITTED and CAN WAIT groups	Reading the report
Silence a test fixture or a false positive	Suppressing findings
Look up a flag	Flags
See which providers are covered	Rules
Feed SARIF to a code-scanning dashboard	Output and exit codes

Related

• SAST runs the rules of kind sast over the same files.
• IaC scanning runs the rules of kind iac. VNX-TF-008 (AWS keys in Terraform) is a secrets rule and runs here, not there.
• Malware inspects installed dependencies, which this command skips.

GitHub Actions

Run it in a workflow with the secrets GitHub Action: it uploads the findings to code scanning under the vulnetix/secrets/ category, keeps the files as an artifact and attests them.

Platform IaC

Secret detection has no config kind of its own. Its pass or fail threshold can come from the organisation’s quality gate, the QualityGate kind. See the kind catalogue.