Secret Scanning

CodeScan automatically scans every source file for hardcoded credentials — API keys, tokens, passwords, connection strings, and private keys. It runs in parallel with the AI pipeline the moment files are uploaded, with zero configuration.

What gets detected

How it works

Each file is scanned against 24 regex patterns tuned to the exact formats used by each service. Placeholder values (your-api-key, REPLACE_ME, etc.) are automatically excluded. The scanner never sends file content to an external service — all matching is done locally in the API function.

Files with .example, .sample, or .template extensions are skipped entirely — these are expected to contain placeholder keys.

UI — SECRETS tab

When secrets are found, the scanner switches to the SECRETS tab automatically and shows a summary with the count of affected files, severity breakdown, the redacted match value, and the file/line location. The actual secret value is never shown — only a redacted form (sk-ant·····key).

CLI

Secret scanning runs automatically on every codescan scan — no extra flags needed.

codescan scan --dir ./src

# Secrets appear in their own section after the code findings summary:
⚑ SECRET SCAN — 2 secret(s) found in 1 file
  CRITICAL  src/config.ts:12   AWS Access Key ID      AKIA····K2YA
  HIGH      src/config.ts:13   Stripe Secret Key      sk_live·····3kD

# Exit code 2 if any critical secrets are found (in addition to gate exit code 1)

API endpoint

POST https://codesscan.com/api/scan/secrets
Content-Type: application/json

{ "content": "<file content>", "filename": "config.ts" }

# Response
{
  "filename": "config.ts",
  "count": 2,
  "findings": [
    {
      "patternId":   "aws_access_key",
      "title":       "AWS Access Key ID",
      "severity":    "critical",
      "category":    "Cloud Credentials",
      "line":        12,
      "column":      18,
      "match":       "AKIA·····2YA",
      "cwe":         "CWE-798",
      "owasp":       "A02:2021 — Cryptographic Failures",
      "description": "...",
      "recommendation": "..."
    }
  ]
}

What to do when a secret is found

• Rotate immediately — treat any detected secret as compromised. Revoke it and issue a new one regardless of whether the file is public or private.
• Remove from source — delete the secret from the file and all git history using git filter-repo or BFG Repo Cleaner.
• Use environment variables — inject credentials at runtime via process.env.SECRET_NAME or a secrets manager (AWS Secrets Manager, HashiCorp Vault, Doppler).