Quickstart

You need the Vulnetix CLI on your PATH (installing the CLI). No sign-in is needed: without credentials the scan runs and reports locally.

1. Scan

Run it from the repository root:

vulnetix secrets

The scan reads the working tree to three directory levels and the last 500 commits. For a deep tree, raise the depth:

vulnetix secrets --depth 10

2. Read the result

The terminal report groups findings by credential: one row per distinct value, however many files hold it.

 ✖ SECRETS 2 credentials in 3 places          1 to rotate · 1 not committed
   1092 rules ran · one value in several files counts once · values are never printed

 ROTATE NOW · 1 credential · committed to production code
 ──────────────────────────────────────────────────────────────────────────────
 ● CRITICAL  AWS access key ID       VNX-SEC-001  deploy/prod.tfvars:14
             committed in a1b2c3d, 41 days ago   also in .env.example:3

Ask for the rotation steps and every place the credential appears:

vulnetix secrets --explain VNX-SEC-001

Reading the report explains each group.

3. Fail the build

--fail-on takes a severity. The run exits 1 when any secrets finding is at or above it:

vulnetix secrets --fail-on high

In a pipeline, keep the SARIF file for your code-scanning dashboard and print nothing when the scan is clean:

vulnetix secrets --depth 10 --fail-on high -q -o secrets.sarif

A GitHub Actions job:

jobs:
  secrets:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0          # the history pass needs the commits
      - name: Install the Vulnetix CLI
        run: curl -fsSL https://cli.vulnetix.com/install.sh | sh
      - name: Scan for secrets
        run: vulnetix secrets --depth 10 --fail-on high -o secrets.sarif

4. Deal with a false positive

Mark the line in the source with a nosec comment naming the rule:

EXAMPLE_KEY = "AKIAIOSFODNN7EXAMPL3"  # nosec VNX-SEC-001

or record a rule that the whole organisation shares:

vulnetix ignore add --category secrets --rule VNX-SEC-001 --file docs/example.env \
  --type false_positive --reason "documented example key"

Suppressing findings covers both.

Next

• Flags for every option.
• Output and exit codes for the files written and what is uploaded.