Security

A credential reaches a repository in one of two ways: it was written into a file that should have been ignored, or it was pasted into something — a config sample, a test fixture, a README — where nobody expected to look for it later. Both are easier to catch before the commit than after it.

The Secret & API Key Scanner checks text you paste for the shapes credentials usually take: provider-prefixed API keys, bearer tokens, private key blocks, connection strings with inline passwords. Run it over a diff before committing, over a config file before sharing it, or over a log excerpt before attaching it to a ticket.

Pattern matching finds credentials that look like credentials. It will not find a password that looks like an ordinary word, a key stored in an unusual format, or a token from a provider whose format it does not know. A clean result means nothing matched the patterns checked — it is not proof that the text is safe, and it should never be the only control between a credential and a repository.

If a credential has already been committed, treat rotation as the fix rather than deletion. Rewriting history does not help once the commit has been pushed, cloned, cached by a mirror or read by anything watching the repository. Revoke the credential first, then worry about the history.

The Secret Scanner is the one route on this site that loads no advertising script at all — excluded at the router level rather than hidden with styling, because a hidden slot still makes the request. People paste live credentials into that page, and we would rather carry no advertising there than qualify the promise.

Findings are masked in the interface and in every download. The tool never echoes a full credential back to you.