Skip to main content

​
Overview

CodeAnt AI’s Secrets Detection feature helps you safeguard your codebase by automatically identifying and protecting sensitive information such as API keys, tokens, and other secrets. By integrating this feature, you can prevent accidental exposure of critical data and ensure your project’s security.

​
What CodeAnt detects

CodeAnt AI combines two detection methods:
  • Provider-specific rules for more than 400 credential types, including AWS, Azure and Google Cloud keys, GitHub and GitLab tokens, Stripe, OpenAI and Anthropic API keys, Slack and Discord tokens, and database connection strings.
  • Pattern and entropy checks for private keys, JSON Web Tokens, basic-auth credentials, keyword matches and high-entropy strings.
AI then reviews findings to filter out false positives. To guide that review, add a Custom False-Positive Prompt in Settings > Analysis Configuration.

​
Check whether a secret is still active

CodeAnt AI checks each detected credential with its provider and marks it Live, Revoked or Inconclusive, so you can rotate the active ones first. To see how a verdict was reached, open the secret. How this is validated shows the read-only request CodeAnt AI sends to the provider and the response that makes a secret Live or Revoked. The secret itself appears only as a placeholder. Live validation is on by default. To turn it off, open Settings > Analysis Configuration and clear Live Secret Validation under Security.

​
Find secrets in your Git history (beta)

A secret deleted from your code still exists in earlier commits and can be used until it is revoked. When Secrets Analysis runs, CodeAnt AI also scans every branch and tag in the repository’s history.
  • Open the repository’s secrets results from Repositories and select Historical Secrets (Beta). The tab lists only secrets confirmed to be active, one row per secret. The commit column shows the first commit and how many others contain the secret; hover over it to list them all.
  • Open a row to read the code at that commit. When the secret appears in more than one commit, use Commits to switch between them.
  • Dismiss secrets or create tickets from this tab, the same way as on Exposed Secrets.
  • Active secrets from history also appear in the Hotlist as the Historical Secrets type. Their details list every commit, each linking to the file at that commit.
History scanning is on by default. To turn it off, open Settings > Analysis Configuration and clear Git History Secret Scan under Security.