> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/capabilities/code-reviews/secrets-detection.md).

# Secrets Detection

## Overview

Nullify prevents credential leaks and sensitive data exposure from entering your repositories as a core part of Code Review. It identifies hardcoded credentials and sensitive data that should never be in version control, then validates whether those credentials are actually live and exploitable. This combines deterministic pattern matching with NLP-based detectors and real-world validation—catching not just secrets that look dangerous, but secrets that pose an actual risk.

## Detection Highlights

* **Cloud & infrastructure keys** — AWS access keys, Azure service-principal credentials, GCP API keys and service-account JSON keys, IBM COS, HashiCorp Terraform passwords, DigitalOcean and SoftLayer credentials.
* **Developer tooling** — GitHub personal access tokens, npm/yarn tokens, Slack webhooks, SendGrid API keys, Stripe, Square, Artifactory, Docker Hub, and more.
* **Authentication artefacts** — OAuth client secrets, JWTs, basic-auth credentials, and session identifiers.
* **Sensitive data** — Email addresses, phone numbers, addresses, dates of birth, US Social Security Numbers, and payment card details in English-language datasets. Available to enterprise tenants on request — see [Confidential Data Detection](/capabilities/code-reviews/secrets-detection/confidential-data-detection.md).

Credential findings include ownership and remediation guidance where available. Rotate or revoke a leaked credential at its provider; removing it from a commit or allowlisting it does not revoke access. Sensitive-data findings follow a separate exposure-remediation workflow.

## Live credential verification

A leaked secret that's already been rotated is noise; a leaked secret that still works is an incident. Nullify tells them apart. When it finds a credential, it checks it against the real provider — across a broad set of services including AWS, GCP, Azure, GitHub and GitLab tokens, Stripe, Slack, and many more — to determine whether it's still live, and captures evidence of what the credential can access. A verified-live secret is prioritized and escalated ahead of one that no longer works, so the most urgent leaks reach the right owner first. This is functional testing, not just pattern matching.

## Beyond cloud tokens

Coverage includes AI-provider keys, package-publishing credentials, CI tokens, and private cryptographic keys. See [Supported Secret Categories](/capabilities/code-reviews/secrets-detection/supported-secret-categories.md) for the distinction between live-verifiable credentials, provider patterns, and structural key classification.

## After a leak

Revoke or rotate a leaked credential at its issuing provider, then update affected applications. Removing a secret from source or suppressing its finding does not revoke the credential. Nullify's live-verification capability does not establish scheduled re-verification, automatic revocation, or a vault-management workflow.