> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/capabilities/code-reviews/secrets-detection/supported-secret-categories.md).

# Supported Secret Categories

Detection, structural classification, and live verification are different stages. A provider pattern can identify a likely credential without a supported online verifier. Verification can also be inconclusive when a service is unreachable or required account context is missing.

| Category                         | Examples with live-verification tools                                                                                                                                                                                        |
| -------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Cloud and infrastructure         | AWS access-key pairs; Google Cloud API keys and service-account JSON keys; Azure service-principal client credentials; DigitalOcean, IBM Cloud, Heroku, Terraform Cloud, Vault, Pulumi, Vercel, Netlify, Firebase, Supabase. |
| Source control, CI, and packages | GitHub and GitLab tokens; npm, PyPI, RubyGems, CircleCI, Travis CI, Docker Hub, and Bitbucket credentials.                                                                                                                   |
| AI and model platforms           | OpenAI, Hugging Face, and Fireworks tokens.                                                                                                                                                                                  |
| Observability and data           | Datadog, Databricks, Dynatrace, Sentry, Splunk, Elasticsearch, New Relic, LaunchDarkly, Mapbox, and Algolia.                                                                                                                 |
| Identity and collaboration       | Okta, Notion, Dropbox, Postman, Slack, Discord, Telegram, Facebook, Airtable, Atlassian, Linear, and Zendesk.                                                                                                                |
| Commerce and communications      | Stripe, Square, Shopify, HubSpot, SendGrid, Mailchimp, Twilio, PagerDuty, Cloudflare, and Braintree.                                                                                                                         |

These examples describe supported verifier types, not a promise that every alert will make an online request. Required hostnames, tenant IDs, paired secrets, scopes, and provider responses determine what can be verified. Azure service-principal verification uses an OAuth client-credentials exchange; it is not a general verifier for every Storage SAS token.

## Pattern-detected credentials

Provider-specific patterns also recognize Anthropic, DeepSeek, Gemini, Groq, OpenRouter, xAI, and Replicate keys. Generic API keys, basic-auth strings, bearer tokens, and signing secrets are assessed using their format and surrounding code. Do not interpret “detected” as “confirmed live.”

## Cryptographic material

Nullify distinguishes PEM and SSH private keys from public keys, certificates, and password hashes. A structurally valid private key can be sensitive even without an API endpoint against which to verify it. A public certificate or public key is not automatically a leaked credential, and a password hash is not an API token. Triage uses the material's role and context rather than inventing provider access from its shape.

## Personal and sensitive data

Email addresses, phone numbers, postal addresses, dates of birth, US Social Security Numbers, and payment-card details are covered by [Confidential Data Detection](/capabilities/code-reviews/secrets-detection/confidential-data-detection.md), when enabled. These findings require exposure remediation rather than credential rotation.

Contact Nullify for a provider or credential format not listed here.