🕵️Secret Detection

Summary

Arnica detects hardcoded secrets within all commits of each source code repository it scans, and defines the risk severity for each secret Identified. The risk severity is determined using Arnica's native validation logic or in the case of custom secrets, the severity is defined within the customer's custom regex detectors.

Secret validation capabilities

Arnica maintains a library of validators used to determine the validity, risk level and exploitability of each hardcoded secret. Once a secret has been identified and validated output from these validators is used to determine the severity and priority of the secret.

Secret Support Matrix

The complete matrix below identifies every secret type Arnica can detect and validate. Expand a secret type under Validation details by secret type below the matrix to view its live validation results and corresponding risks. Supported severities are Critical, High, Medium, Low, Info, and Unknown.

The following outcomes apply to every secret type:

• An Invalid secret is assigned Info severity.

• A None result is assigned Unknown severity when validation cannot complete because the service is unreachable, rate-limited, or returns a 5xx response.

• A secret type without a validator receives a None result and Unknown severity, and requires manual validation.

Secret Type	Detection	Validation
Adafruit API Key	✅
Adobe Client ID (OAuth Web)	✅
Adobe Client Secret	✅
Age secret key	✅
Airtable API Key	✅
Algolia API Key	✅
Alibaba AccessKey ID	✅
Alibaba Secret Key	✅
Asana Client ID	✅
Asana Client Secret	✅
Atlassian API token	✅
Auth0 Client Secret	✅	✅
Authress Service Client Access Key	✅
AWS Access Token	✅	✅
Azure Storage	✅	✅
Azure Tenant ID and Access Key	✅	✅
Base64 Encoded GitHub Fine-Grained Personal Access Token	✅	✅
Base64 Encoded GitHub Personal Access Token	✅	✅
Beamer API token	✅
Bitbucket Client ID	✅
Bitbucket Client Secret	✅
Bittrex Access Key	✅
Bittrex Secret Key	✅
CircleCI API Token	✅	✅
Clojars API token	✅
Codecov Access Token	✅
Coinbase Access Token	✅
Confluent Access Token	✅
Confluent Secret Key	✅
Contentful delivery API token	✅
CosmosDB Endpoint Access	✅	✅
Credentials in Web URL	✅	✅
Databricks API token	✅	✅
Datadog Access Token	✅	✅
Defined Networking API token	✅
DigitalOcean OAuth Access Token	✅
DigitalOcean OAuth Refresh Token	✅
DigitalOcean Personal Access Token	✅
Discord API key	✅
Discord client ID	✅
Discord client secret	✅
Doppler API token	✅
Droneci Access Token	✅
Dropbox API secret	✅
Dropbox long lived API token	✅
Dropbox short lived API token	✅
Duffel API token	✅
Dynatrace API token	✅
EasyPost API token	✅
EasyPost test API token	✅
Etsy Access Token	✅
Facebook Access Token	✅
Fastly API key	✅
Finicity API token	✅
Finicity Client Secret	✅
Finicity Public Key	✅
Finnhub Access Token	✅
Flickr Access Token	✅
Flutterwave Encryption Key	✅	✅
Flutterwave Secret Key	✅	✅
Frame.io API token	✅
Freshbooks Access Token	✅
GCP Access Token	✅	✅
GCP API key	✅	✅
Generic API Key	✅
GitHub App Token	✅	✅
GitHub Fine-Grained Personal Access Token	✅	✅
GitHub OAuth Access Token	✅	✅
GitHub Personal Access Token	✅	✅
GitHub Refresh Token	✅	✅
GitLab Personal Access Token	✅
GitLab Pipeline Trigger Token	✅
GitLab Runner Registration Token	✅
Gitter Access Token	✅
GoCardless API token	✅
Grafana API key (or Grafana cloud API key)	✅
Grafana cloud API token	✅
Grafana Service Account Token	✅
HashiCorp Terraform user/org API token	✅
Heroku API Key	✅
HubSpot API Token	✅
Intercom API Token	✅
JFrog Artifactory	✅	✅
JSON Web Token	✅	✅
Kraken Access Token	✅
Kucoin Access Token	✅
Kucoin Secret Key	✅
Launchdarkly Access Token	✅
Linear API Token	✅
Linear Client Secret	✅
LinkedIn Client ID	✅
LinkedIn Client secret	✅
Lob API Key	✅
Lob Publishable API Key	✅
Mailchimp API key	✅
Mailgun private API token	✅	✅
Mailgun public validation key	✅
Mailgun webhook signing key	✅
MapBox API token	✅
Mattermost Access Token	✅
MessageBird API token	✅
MessageBird Client ID	✅
Microsoft Teams Webhook	✅
Netlify Access Token	✅
New Relic API Key	✅	✅
New Relic ingest browser API token	✅
New Relic user API ID	✅
New Relic user API Key	✅
Npm Access Token	✅	✅
Nytimes Access Token	✅
Okta Access Token	✅
OpenAI API Key	✅	✅
Plaid API Token	✅
Plaid Client ID	✅
Plaid Secret key	✅
PlanetScale API token	✅
PlanetScale OAuth token	✅
PlanetScale password	✅
Postman API token	✅
Prefect API token	✅
Private Key	✅	✅
Pulumi API token	✅
PyPI upload token	✅
RapidAPI Access Token	✅
Readme API token	✅
Rubygem API token	✅
Sendbird Access ID	✅
Sendbird Access Token	✅
SendGrid API token	✅	✅
Sendinblue API token	✅
Sentry Access Token	✅
Shippo API token	✅
Shopify access token	✅
Shopify custom access token	✅
Shopify private app access token	✅
Shopify shared secret	✅
Sidekiq Secret	✅
Sidekiq Sensitive URL	✅
Slack App-level token	✅
Slack Bot token	✅	✅
Slack Configuration access token	✅
Slack Configuration refresh token	✅
Slack Legacy bot token	✅
Slack Legacy token	✅
Slack Legacy Workspace token	✅
Slack User	✅
Stripe API Token	✅	✅

Secret validation types

Arnica provides 3 primary validation outcomes, as described below.

Valid

Arnica performs various validation actions to identify the validity of each secret, such as authenticating with the identified credentials, non-intrusive fuzzing, querying DNS, and executing brute force attacks against offline resources (e.g. encrypted private keys).

Each secret type has a range of severities. For example, an encrypted private key would be classified as a medium severity, but if Arnica managed to brute force the passphrase to this encrypted private key, the secret will be classified as a high risk.

Invalid

Based on the validation logic explained above, it might be determined that a secret is no longer valid. For example, if the client id and secret of given AWS credentials cannot be used to successfully authenticate, Arnica will determine that the secret is invalid.

In most cases, invalid secrets would be classified as info severity.

None

While Arnica has many hardcoded secret validation types, certain secrets don't have validators, such as generic API keys - high entropy strings that can be potentially used to authenticate to various services.

The risk severity for such secrets will always be classified as unknown, as they require manual validation. Custom regex secrets defined by customers will have a pre-defined severity as specified in the regex configuration.

Validation details by secret type

Select a secret type to expand its validation outcomes and risk levels.

Auth0 Client Secret

Live validation result	Validation type	Risk
Valid client secret	Valid	Critical
Secret is invalid or has insufficient permissions (401 or 403)	Invalid	Info
Validation cannot complete because the service is unreachable, rate-limited, or returns a 5xx response	None	Unknown

AWS Access Token

Live validation result	Validation type	Risk
Valid credentials for a root identity	Valid	Critical
Valid credentials for a service account	Valid	High
Valid credentials for a standard identity	Valid	High
Valid credentials for a development, test, or demo environment	Valid	Medium
Valid canary or honeypot credentials	Valid	Info
Secret is invalid or has insufficient permissions (401 or 403)	Invalid	Info
Validation cannot complete because the service is unreachable, rate-limited, or returns a 5xx response	None	Unknown

Azure Storage

Live validation result	Validation type	Risk
Valid credentials for an administrator or root account	Valid	Critical
Valid credentials for a standard account	Valid	High
Valid credentials for a development, test, or demo environment	Valid	Medium
Secret is invalid or has insufficient permissions (401 or 403)	Invalid	Info
Validation cannot complete because the service is unreachable, rate-limited, or returns a 5xx response	None	Unknown

Azure Tenant ID and Access Key

Live validation result	Validation type	Risk
Valid access token	Valid	High
Secret is invalid or has insufficient permissions (401 or 403)	Invalid	Info
Validation cannot complete because the service is unreachable, rate-limited, or returns a 5xx response	None	Unknown

Base64 Encoded GitHub Fine-Grained Personal Access Token

Live validation result	Validation type	Risk
Valid token with full access	Valid	High
Valid token restricted by SSO, an IP allow-list, or limited permissions	Valid	Medium
Secret is invalid or has insufficient permissions (401 or 403)	Invalid	Info
Validation cannot complete because the service is unreachable, rate-limited, or returns a 5xx response	None	Unknown

Base64 Encoded GitHub Personal Access Token

Live validation result	Validation type	Risk
Valid token with full access	Valid	High
Valid token restricted by SSO, an IP allow-list, or limited permissions	Valid	Medium
Secret is invalid or has insufficient permissions (401 or 403)	Invalid	Info
Validation cannot complete because the service is unreachable, rate-limited, or returns a 5xx response	None	Unknown

CircleCI API Token

Live validation result	Validation type	Risk
Valid token for an administrator or root account	Valid	Critical
Valid token for a standard account	Valid	High
Valid token for a test, development, or QA account, or an account without projects	Valid	Low
Secret is invalid or has insufficient permissions (401 or 403)	Invalid	Info
Validation cannot complete because the service is unreachable, rate-limited, or returns a 5xx response	None	Unknown

CosmosDB Endpoint Access

Live validation result	Validation type	Risk
Valid access to an administrator or root resource	Valid	Critical
Valid access to a standard resource	Valid	High
Valid access to a development, test, or demo resource	Valid	Medium
Secret is invalid or has insufficient permissions (401 or 403)	Invalid	Info
Validation cannot complete because the service is unreachable, rate-limited, or returns a 5xx response	None	Unknown

Credentials in Web URL

Live validation result	Validation type	Risk
Credentials return a successful 2xx JSON response or a 3xx redirect	Valid	Medium
Credentials return a successful 2xx non-JSON response with lower confidence	Valid	Low
Secret is invalid or has insufficient permissions (401 or 403)	Invalid	Info
Validation cannot complete because the service is unreachable, rate-limited, or returns a 5xx response	None	Unknown

Databricks API token

Live validation result	Validation type	Risk
Valid token	Valid	High
Secret is invalid or has insufficient permissions (401 or 403)	Invalid	Info
Validation cannot complete because the service is unreachable, rate-limited, or returns a 5xx response	None	Unknown

Datadog Access Token

Live validation result	Validation type	Risk
Valid token	Valid	High
Secret is invalid or has insufficient permissions (401 or 403)	Invalid	Info
Validation cannot complete because the service is unreachable, rate-limited, or returns a 5xx response	None	Unknown

Flutterwave Encryption Key

Live validation result	Validation type	Risk
Valid key with access to live data	Valid	Critical
Valid key that returns no data	Valid	High
Valid key for an environment without subscriptions	Valid	Low
Valid test key	Valid	Info
Secret is invalid or has insufficient permissions (401 or 403)	Invalid	Info
Validation cannot complete because the service is unreachable, rate-limited, or returns a 5xx response	None	Unknown

Flutterwave Secret Key

Live validation result	Validation type	Risk
Valid key with access to live data	Valid	Critical
Valid key that returns no data	Valid	High
Valid key for an environment without subscriptions	Valid	Low
Valid test key	Valid	Info
Secret is invalid or has insufficient permissions (401 or 403)	Invalid	Info
Validation cannot complete because the service is unreachable, rate-limited, or returns a 5xx response	None	Unknown

GCP Access Token

Live validation result	Validation type	Risk
Valid token with admin or full_control scope	Valid	Critical
Valid token without admin or full_control scope	Valid	High
Secret is invalid or has insufficient permissions (401 or 403)	Invalid	Info
Validation cannot complete because the service is unreachable, rate-limited, or returns a 5xx response	None	Unknown

GCP API key

Live validation result	Validation type	Risk
Valid key with Gemini access	Valid	High
Valid key without Gemini access	Valid	Low
Secret is invalid or has insufficient permissions (401 or 403)	Invalid	Info
Validation cannot complete because the service is unreachable, rate-limited, or returns a 5xx response	None	Unknown

GitHub App Token

Live validation result	Validation type	Risk
Valid token with full access	Valid	High
Valid token restricted by SSO, an IP allow-list, or limited permissions	Valid	Medium
Secret is invalid or has insufficient permissions (401 or 403)	Invalid	Info
Validation cannot complete because the service is unreachable, rate-limited, or returns a 5xx response	None	Unknown

GitHub Fine-Grained Personal Access Token

Live validation result	Validation type	Risk
Valid token with full access	Valid	High
Valid token with restricted access	Valid	Medium
Secret is invalid or has insufficient permissions (401 or 403)	Invalid	Info
Validation cannot complete because the service is unreachable, rate-limited, or returns a 5xx response	None	Unknown

GitHub OAuth Access Token

Live validation result	Validation type	Risk
Valid token with full access	Valid	High
Valid token with restricted access	Valid	Medium
Secret is invalid or has insufficient permissions (401 or 403)	Invalid	Info
Validation cannot complete because the service is unreachable, rate-limited, or returns a 5xx response	None	Unknown

GitHub Personal Access Token

Live validation result	Validation type	Risk
Valid token with full access	Valid	High
Valid token with restricted access	Valid	Medium
Secret is invalid or has insufficient permissions (401 or 403)	Invalid	Info
Validation cannot complete because the service is unreachable, rate-limited, or returns a 5xx response	None	Unknown

GitHub Refresh Token

Live validation result	Validation type	Risk
Valid token with full access	Valid	High
Valid token with restricted access	Valid	Medium
Secret is invalid or has insufficient permissions (401 or 403)	Invalid	Info
Validation cannot complete because the service is unreachable, rate-limited, or returns a 5xx response	None	Unknown

JFrog Artifactory

Live validation result	Validation type	Risk
Valid token	Valid	Critical
Secret is invalid or has insufficient permissions (401 or 403)	Invalid	Info
Validation cannot complete because the service is unreachable, rate-limited, or returns a 5xx response	None	Unknown

JSON Web Token

Live validation result	Validation type	Risk
Token verified by its claims and signature	Valid	High or Medium
Token matches test-data patterns	Valid	Info
Secret is invalid or has insufficient permissions (401 or 403)	Invalid	Info
Validation cannot complete because the service is unreachable, rate-limited, or returns a 5xx response	None	Unknown

Mailgun private API token

Live validation result	Validation type	Risk
Valid key	Valid	Medium
Secret is invalid or has insufficient permissions (401 or 403)	Invalid	Info
Validation cannot complete because the service is unreachable, rate-limited, or returns a 5xx response	None	Unknown

New Relic API Key

Live validation result	Validation type	Risk
Valid key with access to live applications	Valid	High
Valid key with no applications found	Valid	Low
Secret is invalid or has insufficient permissions (401 or 403)	Invalid	Info
Validation cannot complete because the service is unreachable, rate-limited, or returns a 5xx response	None	Unknown

Npm Access Token

Live validation result	Validation type	Risk
Valid token with package access	Valid	High
Valid token for a demo or test user, an account without packages, or an IP-restricted account	Valid	Low
Secret is invalid or has insufficient permissions (401 or 403)	Invalid	Info
Validation cannot complete because the service is unreachable, rate-limited, or returns a 5xx response	None	Unknown

OpenAI API Key

Live validation result	Validation type	Risk
Valid key	Valid	High
Secret is invalid or has insufficient permissions (401 or 403)	Invalid	Info
Validation cannot complete because the service is unreachable, rate-limited, or returns a 5xx response	None	Unknown

Private Key

Live validation result	Validation type	Risk
Passwordless private key or key with a successfully brute-forced passphrase	Valid	High
Passphrase-protected or encrypted private key	Valid	Medium
Certificate	Valid	Low
Secret is invalid or has insufficient permissions (401 or 403)	Invalid	Info
Validation cannot complete because the service is unreachable, rate-limited, or returns a 5xx response	None	Unknown

SendGrid API token

Live validation result	Validation type	Risk
Valid token	Valid	Medium
Secret is invalid or has insufficient permissions (401 or 403)	Invalid	Info
Validation cannot complete because the service is unreachable, rate-limited, or returns a 5xx response	None	Unknown

Slack Bot token

Live validation result	Validation type	Risk
Valid token	Valid	Low
Secret is invalid or has insufficient permissions (401 or 403)	Invalid	Info
Validation cannot complete because the service is unreachable, rate-limited, or returns a 5xx response	None	Unknown

Stripe API Token

Live validation result	Validation type	Risk
Valid token with access to live data	Valid	Critical
Valid token that returns no data	Valid	High
Valid token with access to test data only	Valid	Info
Secret is invalid or has insufficient permissions (401 or 403)	Invalid	Info
Validation cannot complete because the service is unreachable, rate-limited, or returns a 5xx response	None	Unknown

Excluded secrets and paths

False positive hardcoded secrets tend to be identified in many forked repositories, known test paths and file names.

Arnica includes pre-defined excluded paths and file names that are skipped in the detection and issue creation process. These files and paths can be configured or deleted in the policies page under the secrets configurations section.

Detection scope and scan timing

Arnica identifies hardcoded secrets through:

• Real-time push scanning for newly introduced commits on monitored branches.

• Scheduled scans for broader repository coverage and status reconciliation.

Secrets that exist only in local, unpushed branches are not visible to Arnica until pushed to the integrated SCM.

Troubleshooting common outcomes

Secret was committed but does not appear

If a leaked secret is not visible:

1. Confirm the commit was pushed to a repository and branch covered by the integration.

2. Confirm the file path is not excluded in Secrets Policy Settings.

3. Confirm enough time has passed for the relevant scan cycle (real-time push event or routine scan).

Secret was fixed but finding still appears open

Finding status is reconciled after a subsequent scan observes the updated file state.

1. Verify the remediation is committed to the relevant monitored branch.

2. Wait for the next routine scan if no new push event occurs.

3. Re-check the finding after the next processing cycle.

Large historical false-positive backlog

For bulk cleanup (for example, generated archives or crawled content), keep ignore rules in place to prevent new noise and dismiss existing findings in bulk using the API.

Use the Arnica API reference for bulk finding workflows: Arnica API Swagger.