Secrets Detection

Find every secret
and know which ones still work

Nullify's secrets detection catches hardcoded credentials in code review, then tests each one against the real provider. Live keys go to the top of the queue with an owner attached.

Book a Demo Read the Docs

Live verification3 candidates

AWS access keyLive

GitHub tokenLive

Stripe secret keyrotated

Fewer alerts, with the live keys first

What reaches your teamShare of candidate secretsCheck

Nullify

verified live

Pattern + NLP match

looks real

Regex-only scanner

looks like a key

Illustrative example. Real ratios depend on your codebase.

7+

providers checked live, including
AWS, GCP, Azure, GitHub and Stripe

2

detection methods, pattern matching
and NLP, on every candidate

A scan tells you a secret leaked.
Nullify tells you if it still works.

Keys get rotated, revoked and re-used. Nullify checks each one against the live provider, and every answer names the evidence it came from.

Secret scanStale

A scan matches strings.

It can't tell a live key from a dead one.

Last checked 14 days ago

AWS key · deploy.ymlpossible secret

Stripe key · .env.examplepossible secret

GitHub token · ci.ymlpossible secret

Slack webhook · old branchpossible secret

NullifyLive

Nullify verifies each one.

Checked against the provider itself.

Last checked just now

AWS key · deploy.ymlLive · rotate now

Stripe key · .env.exampleRevoked

GitHub token · ci.ymlLive · repo write

Slack webhook · old branchInactive

Is the leaked AWS key still live?

Yes. It authenticated against AWS just now and can write to the exports bucket. The owner has been notified with the rotation steps.

Sources

Git historyAWS STSIAM policyCODEOWNERS

config / deploy.ymlread · just now

Move from a list of maybe-secrets
to the keys that still open a door

Detect

Finds what regex misses

Pattern matching catches credentials with a known format. NLP catches free-form secrets that don't follow one, like a password left in a comment.

Code review · acme/payments-api #482

config/prod.yaml:14 aws_secret_access_key: wJal…EKEY

Pattern match · AWS secret access key

scripts/seed.py:88 # prod db pass is Tr0ub4dor-prod

NLP match · free-form password in a comment

Provider check

✓Key is live. Authenticated against AWS.

verification · 3 candidates

AWS · authenticated live
GitHub · authenticated live
Stripe · rejected · rotated

Verify

Checked against the real provider

Each candidate is tested by authenticating with the provider that issued it. A key that works is an active exposure, not a pattern match.

Every secret, narrowed down

Each step cuts the list. By the time a finding reaches someone, it's confirmed live, ranked, and addressed to the person who can rotate it.

01

Detect

02

Verify

03

Prioritize

04

Owner paged

The finding names a suspected owner and comes with rotation guidance, so the right person acts first.

LiveAWS access key · config/prod.yaml

Suspected owner @j.chen

Create a replacement key at the provider
Update the services that use it
Deactivate the leaked key

Rotation guidance attachedRanked first

Leaks get caught in code review, not after the breach

Secrets detection runs as part of Nullify's code review, so a hardcoded credential is flagged on the pull request that adds it. Live keys are escalated to their suspected owner ahead of everything else.

Nullify · live verification

→ 3 candidate secrets in acme/payments-api #482
→ checking AWS access key … authenticated · live

Slack · #security-escalations

Nullify9:14 AM

Live AWS key found in payments-api. Suspected owner @j.chen, rotation guidance attached.

Pull request · code review

Openacme/payments-api #482

Add production config

nullify reviewed this PR

This change adds a live AWS key. Removing it from the commit won't revoke it, so rotate it at the provider first.

liveownerrotation guidance

›_ config/prod.yaml+3 lines

12  aws:
13    access_key_id: AKIA…7Q2M
14    secret_access_key: wJal…EKEY
    # ↑ live AWS key · authenticated
    # move to your secrets manager, then rotate

A regex scanner says this looks like a key, while Nullify tells you whether it still works

Test it at the provider

Nullify authenticates with each candidate and captures evidence of what the credential can access.

Rank live above dead

Name a suspected owner

Guide the rotation

Secrets · payments-apiVerifying

SecretLivePriorityOwner

AWS key · config/prod.yamlyes✓ first@j.chen

GitHub token · ci/deploy.shyes✓ first@ops

Stripe key · .env.examplenolow—

Slack webhook · notify.pytesting…——

Works with

One review for secrets and code flaws

PR #482 · code review
→ untrusted input traced to sink
→ IDOR on /api/orders/:id · reachable

Code Security

AI-native static analysis across 16 languages, including business-logic flaws.

Triage queue

✓ Live AWS key · ranked first

Rotated Stripe key · not paged

Triage & Remediation

Prioritize by reachability and impact, then ship merge-ready fixes.

FAQ

Questions teams ask about secrets detection

Secrets Detection docs · Supported secret categories · Code Security · Triage & Remediation

How is this different from a regex-based secrets scanner?

+

Most secrets scanners stop at pattern matching, which means every finding still needs a human to check whether the credential actually works. Nullify goes a step further: after pattern matching and NLP find a candidate, Nullify attempts to authenticate with it against the real provider — AWS, GCP, Azure, GitHub, GitLab, Stripe, Slack. A confirmed-live secret is treated as an active exposure and prioritized; a dead or already-rotated key is still reported, just not paged as urgent.

What happens after a live secret is found?

+

The finding is tagged with a suspected owner and rotation guidance, so the person who can actually rotate the credential is pointed at it directly instead of the whole team getting a generic alert. Live secrets are prioritized ahead of everything else in the queue.

Does Nullify rotate the credential for us?

+

No — rotating a live credential is a provider-side action Nullify doesn't have standing access to perform. Nullify finds the secret, confirms whether it's live, identifies a suspected owner, and provides rotation guidance; a human completes the rotation.

What kinds of secrets does it catch?

+

Findings are sorted into 5 categories, including PII — so hardcoded personal data gets flagged alongside API keys, tokens and other credentials. The full category breakdown is in the docs.

Scoped honestly

Reduce your secrets backlog and lower your MTTR

The AI harness that finds leaked secrets, proves whether they work and routes each one to its owner.

Book a demo Read the Docs