Secrets scans

Protect your organization by detecting hardcoded credentials, API keys, and tokens in source code. Secrets scanning prevents credential theft and lateral movement by closing security gaps from develop

Secrets scanners safeguard your organization by identifying hardcoded credentials, such as API keys, access tokens, private keys, and passwords, embedded in source code, configuration files, and Git history. By detecting exposed secrets at code-time, the secrets scanner closes the gap between development practices and production-time security posture, preventing credential theft, unauthorized access, and lateral movement from silently propagating into live environments.

The Secrets page consolidates all scanner-detected secrets issues across monitored repositories into a single view where you can prioritize, investigate, remediate, and track SLA compliance.

Detection capabilities

Supported file types

Cortex Cloud Application Security scans any plaintext files that are not encrypted, not compressed (for example, not .zip files) and not compiled (for example, not .jar files), for secrets. Additionally, entropy findings look for keywords to lower the noise, and those keywords must be in line with the high entropy string to be flagged.

Entropy Analysis

Cortex Cloud Application Security provides signatures that analyze the randomness of strings within the file. Highly random strings, often referred to as high entropy, can be indicative of a potential secret. To reduce false positives, Cortex Cloud Application Security considers specific keywords that might be associated with secrets alongside the randomness of the data for better accuracy.

Prerequisites

Prerequisite	Description
License	An active Cortex Cloud license with Application Security add-on entitlements
RBAC Role	The AppSec Admin or SOC Analyst role, or an equivalent custom role with issue management permissions
VCS Integration	At least one Version Control System (GitHub, GitLab, Bitbucket, Azure DevOps) integrated and active
Secrets Scanner	The secrets scanner enabled for the target repositories
Periodic or PR Scan	At least one completed periodic scan or PR scan that includes secrets scanning results

Core achievements and use cases

• Shifting security left and developer integration: Detecting hardcoded secrets at code-time, before credentials are exploited, reduces the cost and risk of post-incident credential rotation. Secrets scans identify and flag critical issues such as exposed API keys, access tokens, private keys, and database credentials directly within source code and configuration files across monitored repositories. This scanning integrates seamlessly into development workflows, allowing developers to detect findings locally via the Cortex CLI or IDE plugins
• Accelerating issue remediation. The Cortex Cloud IDE extensions provide guidance on rotating the exposed credential and replacing the hardcoded value with a secrets manager reference, which enables developers to resolve secret issues in the source repository without context-switching to an external tool
• Reducing noise. Urgency-based prioritization isolates the secrets that are active and usable from the strings that merely resemble credentials. The Validation metric separates Valid and Privileged credentials from Invalid and Irrelevant ones, Repository Visibility raises the urgency of a credential exposed in a public repository, and high-entropy detections are excluded from urgency escalation because entropy-based rules generate a high rate of false positives. The Number of Occurrences metric quantifies secret sprawl by counting issues that share the same secret hash across the environment
• Establishing compliance baselines and policy enforcement. Mapping secret issues to the Secrets detection rules that produced them provides auditable evidence of compliance with organizational credential-handling policies. Create and apply custom Secrets rules using the SECRETS and GIT frameworks, and apply policies that define how the platform responds to secret findings, including blocking CI runs or pull requests. For policy configuration, refer to Unified Application Security policies