01
Tier 1
Regex patterns.
Pattern matching sweeps the working tree and commit history for known secret formats: configs, environment files, scripts, CI/CD pipelines, and application source.
Product
Secrets Scanning
Regex catches the obvious. LLMs catch what regex misses. Every confirmed key becomes an attack path the whitebox pentest exploits.
The secrets that regex-only tools miss aren't hiding. They're obfuscated. Credentials constructed by string concatenation, passed through environment indirection, or buried in serialized data. Our two-tier scanner detects them, validates each candidate against the surrounding code, and classifies every confirmed secret by type, scope, and blast radius.
Every secret type, every commit.
Beyond the obvious credential classes, the scanner catches the long tail: tokens in URLs, environment indirection, and high-entropy strings that don't match any known signature. Each confirmed secret hands the pentest one more credential to try.
GitHub
GitHub tokens
Personal access tokens, OAuth tokens, GitHub App credentials.
Third-Party
Vendor API keys
Stripe, Slack webhooks, bot tokens, and other third-party vendor keys.
Entropy
Generic high-entropy strings
Base64 and hex-encoded secrets flagged by entropy analysis when they don't match any known pattern.
URLs
Bearer tokens in URLs
Credentials embedded in URL query parameters or fragments. Easy to leak through logs and referrer headers.
Containers
Environment variable secrets
Secrets set via ENV in Dockerfiles, docker-compose, and config files that ship with the image.
Encoded
Encoded payloads
Secrets buried inside base64 blobs, JWT payloads, or hex-encoded config strings.
Webhooks
Webhook signing secrets
HMAC signing keys for inbound webhooks, often hardcoded in handlers and CI scripts.
Auth
JWT signing secrets
HS256 secrets and RS256 private keys used to sign session tokens, leaked in test files and configs.
Two-tier pipeline.
Tier 1 pattern matching flags known secret formats in milliseconds. Tier 2 LLM validation evaluates each candidate in context and catches the obfuscated exposures regex misses. Every confirmed finding is classified by type, scope, and blast radius before it reaches your queue and the pentest that tries to exploit it.
02
Tier 2
LLM validation.
Every candidate is evaluated by an LLM against the actual code. Is this a real credential, or a placeholder, test fixture, or documentation example? The model also catches non-obvious exposures that pure regex misses.
03
Classify
Type, scope, blast radius.
Every confirmed secret is tagged by type, scope, and blast radius. You see what the credential unlocks before you triage it.
Severity Classification
AWS keys and private keys are Critical. API keys are High.
Findings are auto-classified by blast radius: what the credential can reach, and what its compromise would impact. Cloud credentials and private keys are rated Critical because their scope is broadest. Database credentials and API keys follow as High. Blast radius is exactly what the whitebox pentest sets out to prove: it chains each confirmed credential to the systems it can reach.
See classification rubric →Verified. Deduplicated. Low false positive rate.
Every scan ends with a verification phase: each finding is confirmed against the surrounding code, findings from test files, fixtures, and example documentation are filtered out, and overlapping issues are deduplicated. The result is a report you can actually act on.
For secrets specifically, the LLM re-reads every candidate where it sits in the code before it counts.
Confirm
Every candidate, in its own code
Each finding is evaluated against the actual code before it lands in your queue.
Filter
Tests, fixtures, docs dropped
Findings from test files, fixtures, and documentation examples are filtered out automatically.
Deduplicate
One actionable item
Overlapping findings collapse into a single actionable item, so you triage once instead of three times.
False positive tagging
Mark it once, never re-triage it.
Mark a finding as a false positive once and Keygraph carries that dismissal forward on every subsequent scan. Dismissed issues stop showing up.
See it find your leaked keys.
Schedule a demo and watch Secrets Scanning run against a real repo.