> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/capabilities/code-reviews/secrets-detection/supported-secret-categories.md).

# Supported Secret Categories

## Overview

| Category                            | Example Providers & Tokens                                                                                                                                                | Notes                                                                                                                                       |
| ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| Cloud platforms                     | AWS access keys, Azure Storage SAS tokens, GCP API keys, IBM COS HMAC keys, SoftLayer credentials, HashiCorp Terraform passwords                                          | Alerts include remediation guidance and links to rotation documentation.                                                                    |
| Developer tooling & CI              | GitHub personal access tokens, Bitbucket app passwords, Artifactory API keys, npm access tokens, Slack webhooks, SendGrid API keys, Airtable tokens, Square access tokens | Nullify suppresses known test tokens while flagging production secrets introduced in commits or history.                                    |
| Authentication artefacts            | JWTs, HTTP basic-auth strings, OAuth bearer tokens, webhook signing secrets                                                                                               | Detectors parse headers and base64 payloads to catch embedded credentials.                                                                  |
| Generic API keys                    | High-entropy keys that do not match a known provider but behave like credentials                                                                                          | Rules combine entropy thresholds with contextual keywords to minimise false positives.                                                      |
| Personally identifiable information | Email addresses, phone numbers, postal addresses, dates of birth, payment cards                                                                                           | PII detections are explained in [Confidential Data Detection](/capabilities/code-reviews/secrets-detection/confidential-data-detection.md). |

Have a provider that is not listed? Contact Nullify support to add a managed detector or a custom detection pattern for it.