> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codethreat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets Detection Support

> Complete coverage of secret types and credential patterns detected

CodeThreat uses **Gitleaks v8.24+** for comprehensive secrets detection across your codebase and Git history.

## Detection Methods

**Pattern Matching**: Regex patterns for 200+ known credential formats

**Entropy Analysis**: Detects high-entropy strings likely to be secrets

**Git History Scanning**: Checks all commits, not just current code

**Context Awareness**: Reduces false positives by examining surrounding code

## Supported Secret Types

### Cloud Provider Credentials

**AWS**:

* AWS Access Key ID
* AWS Secret Access Key
* AWS Session Token
* AWS Account ID patterns
* AWS MWS Auth Token

**Azure**:

* Azure Storage Account Keys
* Azure Service Principal credentials
* Azure Subscription Keys
* Azure CosmosDB Keys
* Azure DevOps Personal Access Tokens

**Google Cloud (GCP)**:

* GCP API Keys
* GCP Service Account Keys (JSON)
* Google OAuth credentials
* Firebase credentials
* Google Cloud Storage keys

**DigitalOcean**:

* DigitalOcean Access Tokens
* DigitalOcean Personal Access Tokens
* DigitalOcean OAuth tokens

**Heroku**:

* Heroku API Keys
* Heroku OAuth tokens

**Alibaba Cloud**:

* Alibaba Access Keys
* Alibaba Secret Keys

### SaaS/API Keys

**Payment Processing**:

* Stripe API Keys (Live & Test)
* Stripe Publishable Keys
* Stripe Restricted Keys
* PayPal Client ID/Secret
* Square Access Tokens

**Communication**:

* Twilio API Keys and Auth Tokens
* SendGrid API Keys
* Mailgun API Keys
* Mailchimp API Keys
* Slack Tokens and Webhooks
* Discord Tokens

**Development Tools**:

* GitHub Tokens (Personal Access, OAuth)
* GitLab Tokens
* Bitbucket App Passwords
* Azure DevOps PATs
* CircleCI Tokens
* Travis CI Tokens
* Jenkins API Tokens

**Infrastructure**:

* HashiCorp Vault tokens
* Datadog API Keys
* New Relic API Keys
* Sentry Auth Tokens

**Databases**:

* MongoDB Connection Strings
* PostgreSQL Connection Strings
* MySQL Connection Strings
* Redis Passwords
* Cassandra Passwords
* Elasticsearch credentials

### Private Keys & Certificates

**SSH Keys**:

* RSA Private Keys
* DSA Private Keys
* EC Private Keys
* ed25519 Private Keys
* OpenSSH Private Keys

**SSL/TLS**:

* Private Key files (.key, .pem)
* Certificate files
* PKCS#12 (.p12, .pfx)
* Java KeyStore (.jks)

**Code Signing**:

* GPG Private Keys
* PGP Private Keys
* Apple Code Signing keys

### Authentication Tokens

**OAuth & JWT**:

* OAuth Client Secrets
* OAuth Refresh Tokens
* JWT Secrets
* Bearer Tokens
* Session Tokens

**Generic Patterns**:

* Generic API Keys
* Generic Secrets
* Generic Passwords
* Basic Auth credentials

## What Gitleaks Scans

### Current Codebase

* All files in repository
* Configuration files (.env, config.yaml, etc.)
* Infrastructure as Code files
* Documentation and README files
* Embedded credentials in code

### Git History

* All commits across all branches
* Deleted files still in history
* Renamed files
* File content before .gitignore was added
* Merge commits

**Why this matters**: Even if you remove a secret, it remains in Git history and should be considered compromised.

## File Types Scanned

**Configuration Files**:

* `.env`, `.env.local`, `.env.production`
* `config.yaml`, `config.json`, `settings.py`
* `.aws/credentials`, `.azure/credentials`
* `.npmrc`, `.pypirc`

**Infrastructure Files**:

* Terraform (`.tf`)
* Kubernetes manifests (`.yaml`)
* Docker Compose files
* CI/CD configs (`.gitlab-ci.yml`, `.github/workflows/`)

**Code Files**:

* All programming languages
* Scripts (bash, python, etc.)
* Database migration files

**Documentation**:

* README.md, documentation files
* Comments in code
* Jupyter notebooks

## What Gitleaks Doesn't Detect

❌ **Encrypted secrets** (they look like random strings)\
❌ **Secrets in binary files** (compiled code, images, etc.)\
❌ **Secrets split across multiple lines** (obfuscation techniques)\
❌ **Custom secret formats** without adding custom rules

## False Positive Handling

**Common false positives**:

* Example credentials in documentation
* Test API keys in test files
* Placeholder values (`YOUR_API_KEY_HERE`)
* High-entropy strings that aren't secrets

**How to reduce false positives**:

* Use `.gitleaksignore` file
* Mark test files/directories for exclusion
* CodeThreat AI can filter test secrets automatically

## Best Practices

**Never commit secrets**: Use environment variables or secret managers

**Rotate compromised secrets**: If found in Git history, consider it compromised

**Use `.gitignore`**: Prevent secrets files from being committed

**Secret managers**: AWS Secrets Manager, HashiCorp Vault, Azure Key Vault

## What's Next?

<CardGroup cols={2}>
  <Card title="IAC Security Support" icon="cloud" href="/reference/iac-support-matrix">
    Infrastructure scanning coverage
  </Card>

  <Card title="Secrets in Practice" icon="key" href="/scanning/scan-types#secrets-detection">
    How secrets scanning works
  </Card>
</CardGroup>