Secret Scanning

Keep credentials out of GitHub, GitLab, and Bitbucket. CloudAEye catches hardcoded credentials, API keys, and tokens on your changed lines before you commit, and again on every pull request.

Book a demo All use cases

Caught on the changed line.

Prevent hardcoded credentials, API keys, and tokens from ever reaching GitHub, GitLab, or Bitbucket.

GitHubpayments-api #233

The change

payments/client.py2 lines added 
import requests

API_TOKEN = "tok_EXAMPLE_NOT_A_REAL_TOKEN"
BASE_URL = "https://api.example.com/v1"

What comes back

payments/client.py:3Secret in code

An API token is hardcoded on a changed line.

Revoke or rotate the token, then remove it from the code.Load it from your secrets manager or an environment variable.

A leaked key is
an incident.

Once a credential is pushed to GitHub, GitLab, or Bitbucket, it lives in your history. CloudAEye looks for credentials on every changed line, before the commit and on the pull request.

Caught before the push.

Pre-commit reviews in your coding agent catch a secret before it leaves your machine. Pull request reviews check every changed line again.

  • Before you commitClaude Code or Codex
  • On the pull requestGitHub, GitLab, Bitbucket
  • Looks forAPI keys, tokens, passwords
See an example

Scanned for leaks.

Edited files are scanned with Gitleaks, to find credentials written into the code.

  • ScannerGitleaks
  • FallbackPattern matching
  • ScansEvery changed line
Read the docs

Rotate, then remove.

Deleting the line is not enough. The finding tells you to revoke or rotate the credential first, then take it out of the code.

  • FirstRevoke or rotate
  • ThenRemove from code
  • Fix plansMarked not_an_edit
Explore Fix Suggestions

A gate, not a suggestion.

Add No Secrets in Code to your PR checklist. Set it to warn the author, or to block the merge until the secret is removed.

  • PR checklistNo Secrets in Code
  • WarningFlags it, merge allowed
  • ErrorBlocks the merge
Explore PR Checklist

Commands

Claude Code
/cloudaeye:security
Codex
$cloudaeye:security
GitHub · Bitbucket · GitLab
@cloudaeye /security

Secret scanning runs as part of the security pass, and of Review and Ultrareview, which include it.