> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/capabilities/code-reviews/secrets-detection.md).

# Secrets Detection

## Overview

Nullify prevents credential leaks and sensitive data exposure from entering your repositories as a core part of Code Review. It identifies hardcoded credentials and sensitive data that should never be in version control, then validates whether those credentials are actually live and exploitable. This combines deterministic pattern matching with NLP-based detectors and real-world validation—catching not just secrets that look dangerous, but secrets that pose an actual risk.

## Detection Highlights

* **Cloud & infrastructure keys** — AWS access keys, Azure storage tokens, GCP API keys, IBM COS, HashiCorp Terraform passwords, DigitalOcean and SoftLayer credentials.
* **Developer tooling** — GitHub personal access tokens, npm/yarn tokens, Slack webhooks, SendGrid API keys, Stripe, Square, Artifactory, Docker Hub, and more.
* **Authentication artefacts** — OAuth client secrets, JWTs, basic-auth credentials, and session identifiers.
* **Sensitive data** — Email addresses, phone numbers, addresses, dates of birth, US Social Security Numbers, and payment card details in English-language datasets.

Every alert includes the suspected owner, expiry guidance, and a recommended rotation workflow. Duplicate events are collapsed where rotation tables already show the value.

## Live credential verification

A leaked secret that's already been rotated is noise; a leaked secret that still works is an incident. Nullify tells them apart. When it finds a credential, it checks it against the real provider — across a broad set of services including AWS, GCP, Azure, GitHub and GitLab tokens, Stripe, Slack, and many more — to determine whether it's still live, and captures evidence of what the credential can access. A verified-live secret is prioritized and escalated ahead of one that no longer works, so the most urgent leaks reach the right owner first. This is functional testing, not just pattern matching.