> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/secrets-scans.md). # Secrets scans Secrets scanners safeguard your organization by identifying hardcoded credentials, such as API keys, access tokens, private keys, and passwords, embedded in source code, configuration files, and Git history. By detecting exposed secrets at code-time, the secrets scanner closes the gap between development practices and production-time security posture, preventing credential theft, unauthorized access, and lateral movement from silently propagating into live environments. The Secrets page consolidates all scanner-detected secrets issues across monitored repositories into a single view where you can prioritize, investigate, remediate, and track SLA compliance. #### Detection capabilities #### Supported file types Cortex Cloud Application Security scans any plaintext files that are not encrypted, not compressed (for example, not .zip files) and not compiled (for example, not .jar files), for secrets. Additionally, entropy findings look for keywords to lower the noise, and those keywords must be in line with the high entropy string to be flagged. #### Entropy Analysis Cortex Cloud Application Security provides signatures that analyze the randomness of strings within the file. Highly random strings, often referred to as high entropy, can be indicative of a potential secret. To reduce false positives, Cortex Cloud Application Security considers specific keywords that might be associated with secrets alongside the randomness of the data for better accuracy. ## Prerequisites | Prerequisite | Description | | ----------------------- | ---------------------------------------------------------------------------------------------------- | | **License** | An active Cortex Cloud license with Application Security add-on entitlements | | **RBAC Role** | The AppSec Admin or SOC Analyst role, or an equivalent custom role with issue management permissions | | **VCS Integration** | At least one Version Control System (GitHub, GitLab, Bitbucket, Azure DevOps) integrated and active | | **Secrets Scanner** | The secrets scanner enabled for the target repositories | | **Periodic or PR Scan** | At least one completed periodic scan or PR scan that includes secrets scanning results | ## Core achievements and use cases * **Shifting security left and developer integration**: Detecting hardcoded secrets at code-time, before credentials are exploited, reduces the cost and risk of post-incident credential rotation. Secrets scans identify and flag critical issues such as exposed API keys, access tokens, private keys, and database credentials directly within source code and configuration files across monitored repositories. This scanning integrates seamlessly into development workflows, allowing developers to detect findings locally via the Cortex CLI or IDE plugins * **Accelerating issue remediation.** The Cortex Cloud IDE extensions provide guidance on rotating the exposed credential and replacing the hardcoded value with a secrets manager reference, which enables developers to resolve secret issues in the source repository without context-switching to an external tool * **Reducing noise.** Urgency-based prioritization isolates the secrets that are active and usable from the strings that merely resemble credentials. The **Validation** metric separates Valid and Privileged credentials from Invalid and Irrelevant ones, **Repository Visibility** raises the urgency of a credential exposed in a public repository, and high-entropy detections are excluded from urgency escalation because entropy-based rules generate a high rate of false positives. The **Number of Occurrences** metric quantifies secret sprawl by counting issues that share the same secret hash across the environment * **Establishing compliance baselines and policy enforcement.** Mapping secret issues to the Secrets detection rules that produced them provides auditable evidence of compliance with organizational credential-handling policies. Create and apply custom Secrets rules using the `SECRETS` and `GIT` frameworks, and apply policies that define how the platform responds to secret findings, including blocking CI runs or pull requests. For policy configuration, refer to [Unified Application Security policies](/application-security/application-security-posture-management-aspm/unified-application-security-policies.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/secrets-scans.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.