> For the complete documentation index, see [llms.txt](https://docs.arnica.io/arnica-documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.arnica.io/arnica-documentation/hardcoded-secrets/secret-detection.md). # Secret Detection ## **Summary** Arnica detects hardcoded secrets within all commits of each source code repository it scans, and defines the risk severity for each secret Identified. The risk severity is determined using Arnica's native validation logic or in the case of custom secrets, the severity is defined within the customer's [custom regex](/arnica-documentation/hardcoded-secrets/secrets-policy-settings.md#custom-secrets) detectors. ## Secret validation capabilities Arnica maintains a library of validators used to determine the validity, risk level and exploitability of each hardcoded secret. Once a secret has been identified and validated output from these validators is used to determine the severity and priority of the secret. ## Secret Support Matrix The complete matrix below identifies every secret type Arnica can detect and validate. Expand a secret type under **Validation details by secret type** below the matrix to view its live validation results and corresponding risks. Supported severities are **Critical**, **High**, **Medium**, **Low**, **Info**, and **Unknown**. The following outcomes apply to every secret type: * An **Invalid** secret is assigned **Info** severity. * A **None** result is assigned **Unknown** severity when validation cannot complete because the service is unreachable, rate-limited, or returns a `5xx` response. * A secret type without a validator receives a **None** result and **Unknown** severity, and requires manual validation.
Secret TypeDetectionValidation
Adafruit API Key✅
Adobe Client ID (OAuth Web)✅
Adobe Client Secret✅
Age secret key✅
Airtable API Key✅
Algolia API Key✅
Alibaba AccessKey ID✅
Alibaba Secret Key✅
Asana Client ID✅
Asana Client Secret✅
Atlassian API token✅
Auth0 Client Secret✅✅
Authress Service Client Access Key✅
AWS Access Token✅✅
Azure Storage✅✅
Azure Tenant ID and Access Key✅✅
Base64 Encoded GitHub Fine-Grained Personal Access Token✅✅
Base64 Encoded GitHub Personal Access Token✅✅
Beamer API token✅
Bitbucket Client ID✅
Bitbucket Client Secret✅
Bittrex Access Key✅
Bittrex Secret Key✅
CircleCI API Token✅✅
Clojars API token✅
Codecov Access Token✅
Coinbase Access Token✅
Confluent Access Token✅
Confluent Secret Key✅
Contentful delivery API token✅
CosmosDB Endpoint Access✅✅
Credentials in Web URL✅✅
Databricks API token✅✅
Datadog Access Token✅✅
Defined Networking API token✅
DigitalOcean OAuth Access Token✅
DigitalOcean OAuth Refresh Token✅
DigitalOcean Personal Access Token✅
Discord API key✅
Discord client ID✅
Discord client secret✅
Doppler API token✅
Droneci Access Token✅
Dropbox API secret✅
Dropbox long lived API token✅
Dropbox short lived API token✅
Duffel API token✅
Dynatrace API token✅
EasyPost API token✅
EasyPost test API token✅
Etsy Access Token✅
Facebook Access Token✅
Fastly API key✅
Finicity API token✅
Finicity Client Secret✅
Finicity Public Key✅
Finnhub Access Token✅
Flickr Access Token✅
Flutterwave Encryption Key✅✅
Flutterwave Secret Key✅✅
Frame.io API token✅
Freshbooks Access Token✅
GCP Access Token✅✅
GCP API key✅✅
Generic API Key✅
GitHub App Token✅✅
GitHub Fine-Grained Personal Access Token✅✅
GitHub OAuth Access Token✅✅
GitHub Personal Access Token✅✅
GitHub Refresh Token✅✅
GitLab Personal Access Token✅
GitLab Pipeline Trigger Token✅
GitLab Runner Registration Token✅
Gitter Access Token✅
GoCardless API token✅
Grafana API key (or Grafana cloud API key)✅
Grafana cloud API token✅
Grafana Service Account Token✅
HashiCorp Terraform user/org API token✅
Heroku API Key✅
HubSpot API Token✅
Intercom API Token✅
JFrog Artifactory✅✅
JSON Web Token✅✅
Kraken Access Token✅
Kucoin Access Token✅
Kucoin Secret Key✅
Launchdarkly Access Token✅
Linear API Token✅
Linear Client Secret✅
LinkedIn Client ID✅
LinkedIn Client secret✅
Lob API Key✅
Lob Publishable API Key✅
Mailchimp API key✅
Mailgun private API token✅✅
Mailgun public validation key✅
Mailgun webhook signing key✅
MapBox API token✅
Mattermost Access Token✅
MessageBird API token✅
MessageBird Client ID✅
Microsoft Teams Webhook✅
Netlify Access Token✅
New Relic API Key✅✅
New Relic ingest browser API token✅
New Relic user API ID✅
New Relic user API Key✅
Npm Access Token✅✅
Nytimes Access Token✅
Okta Access Token✅
OpenAI API Key✅✅
Plaid API Token✅
Plaid Client ID✅
Plaid Secret key✅
PlanetScale API token✅
PlanetScale OAuth token✅
PlanetScale password✅
Postman API token✅
Prefect API token✅
Private Key✅✅
Pulumi API token✅
PyPI upload token✅
RapidAPI Access Token✅
Readme API token✅
Rubygem API token✅
Sendbird Access ID✅
Sendbird Access Token✅
SendGrid API token✅✅
Sendinblue API token✅
Sentry Access Token✅
Shippo API token✅
Shopify access token✅
Shopify custom access token✅
Shopify private app access token✅
Shopify shared secret✅
Sidekiq Secret✅
Sidekiq Sensitive URL✅
Slack App-level token✅
Slack Bot token✅✅
Slack Configuration access token✅
Slack Configuration refresh token✅
Slack Legacy bot token✅
Slack Legacy token✅
Slack Legacy Workspace token✅
Slack User✅
Stripe API Token✅✅
## Secret validation types Arnica provides 3 primary validation outcomes, as described below. ### Valid Arnica performs various validation actions to identify the validity of each secret, such as authenticating with the identified credentials, non-intrusive fuzzing, querying DNS, and executing brute force attacks against offline resources (e.g. encrypted private keys). Each secret type has a range of severities. For example, an encrypted private key would be classified as a `medium` severity, but if Arnica managed to brute force the passphrase to this encrypted private key, the secret will be classified as a `high` risk. ### Invalid Based on the validation logic explained above, it might be determined that a secret is no longer valid. For example, if the client id and secret of given AWS credentials cannot be used to successfully authenticate, Arnica will determine that the secret is invalid. In most cases, invalid secrets would be classified as `info` severity. ### None While Arnica has many hardcoded secret validation types, certain secrets don't have validators, such as `generic API keys` - high entropy strings that can be potentially used to authenticate to various services. The risk severity for such secrets will always be classified as `unknown`, as they require manual validation. [Custom regex](/arnica-documentation/hardcoded-secrets/secrets-policy-settings.md#custom-secrets) secrets defined by customers will have a pre-defined severity as specified in the regex configuration. ### Validation details by secret type Select a secret type to expand its validation outcomes and risk levels.
Auth0 Client Secret | Live validation result | Validation type | Risk | | -------------------------------------------------------------------------------------------------------- | --------------- | -------- | | Valid client secret | Valid | Critical | | Secret is invalid or has insufficient permissions (`401` or `403`) | Invalid | Info | | Validation cannot complete because the service is unreachable, rate-limited, or returns a `5xx` response | None | Unknown |
AWS Access Token | Live validation result | Validation type | Risk | | -------------------------------------------------------------------------------------------------------- | --------------- | -------- | | Valid credentials for a root identity | Valid | Critical | | Valid credentials for a service account | Valid | High | | Valid credentials for a standard identity | Valid | High | | Valid credentials for a development, test, or demo environment | Valid | Medium | | Valid canary or honeypot credentials | Valid | Info | | Secret is invalid or has insufficient permissions (`401` or `403`) | Invalid | Info | | Validation cannot complete because the service is unreachable, rate-limited, or returns a `5xx` response | None | Unknown |
Azure Storage | Live validation result | Validation type | Risk | | -------------------------------------------------------------------------------------------------------- | --------------- | -------- | | Valid credentials for an administrator or root account | Valid | Critical | | Valid credentials for a standard account | Valid | High | | Valid credentials for a development, test, or demo environment | Valid | Medium | | Secret is invalid or has insufficient permissions (`401` or `403`) | Invalid | Info | | Validation cannot complete because the service is unreachable, rate-limited, or returns a `5xx` response | None | Unknown |
Azure Tenant ID and Access Key | Live validation result | Validation type | Risk | | -------------------------------------------------------------------------------------------------------- | --------------- | ------- | | Valid access token | Valid | High | | Secret is invalid or has insufficient permissions (`401` or `403`) | Invalid | Info | | Validation cannot complete because the service is unreachable, rate-limited, or returns a `5xx` response | None | Unknown |
Base64 Encoded GitHub Fine-Grained Personal Access Token | Live validation result | Validation type | Risk | | -------------------------------------------------------------------------------------------------------- | --------------- | ------- | | Valid token with full access | Valid | High | | Valid token restricted by SSO, an IP allow-list, or limited permissions | Valid | Medium | | Secret is invalid or has insufficient permissions (`401` or `403`) | Invalid | Info | | Validation cannot complete because the service is unreachable, rate-limited, or returns a `5xx` response | None | Unknown |
Base64 Encoded GitHub Personal Access Token | Live validation result | Validation type | Risk | | -------------------------------------------------------------------------------------------------------- | --------------- | ------- | | Valid token with full access | Valid | High | | Valid token restricted by SSO, an IP allow-list, or limited permissions | Valid | Medium | | Secret is invalid or has insufficient permissions (`401` or `403`) | Invalid | Info | | Validation cannot complete because the service is unreachable, rate-limited, or returns a `5xx` response | None | Unknown |
CircleCI API Token | Live validation result | Validation type | Risk | | -------------------------------------------------------------------------------------------------------- | --------------- | -------- | | Valid token for an administrator or root account | Valid | Critical | | Valid token for a standard account | Valid | High | | Valid token for a test, development, or QA account, or an account without projects | Valid | Low | | Secret is invalid or has insufficient permissions (`401` or `403`) | Invalid | Info | | Validation cannot complete because the service is unreachable, rate-limited, or returns a `5xx` response | None | Unknown |
CosmosDB Endpoint Access | Live validation result | Validation type | Risk | | -------------------------------------------------------------------------------------------------------- | --------------- | -------- | | Valid access to an administrator or root resource | Valid | Critical | | Valid access to a standard resource | Valid | High | | Valid access to a development, test, or demo resource | Valid | Medium | | Secret is invalid or has insufficient permissions (`401` or `403`) | Invalid | Info | | Validation cannot complete because the service is unreachable, rate-limited, or returns a `5xx` response | None | Unknown |
Credentials in Web URL | Live validation result | Validation type | Risk | | -------------------------------------------------------------------------------------------------------- | --------------- | ------- | | Credentials return a successful `2xx` JSON response or a `3xx` redirect | Valid | Medium | | Credentials return a successful `2xx` non-JSON response with lower confidence | Valid | Low | | Secret is invalid or has insufficient permissions (`401` or `403`) | Invalid | Info | | Validation cannot complete because the service is unreachable, rate-limited, or returns a `5xx` response | None | Unknown |
Databricks API token | Live validation result | Validation type | Risk | | -------------------------------------------------------------------------------------------------------- | --------------- | ------- | | Valid token | Valid | High | | Secret is invalid or has insufficient permissions (`401` or `403`) | Invalid | Info | | Validation cannot complete because the service is unreachable, rate-limited, or returns a `5xx` response | None | Unknown |
Datadog Access Token | Live validation result | Validation type | Risk | | -------------------------------------------------------------------------------------------------------- | --------------- | ------- | | Valid token | Valid | High | | Secret is invalid or has insufficient permissions (`401` or `403`) | Invalid | Info | | Validation cannot complete because the service is unreachable, rate-limited, or returns a `5xx` response | None | Unknown |
Flutterwave Encryption Key | Live validation result | Validation type | Risk | | -------------------------------------------------------------------------------------------------------- | --------------- | -------- | | Valid key with access to live data | Valid | Critical | | Valid key that returns no data | Valid | High | | Valid key for an environment without subscriptions | Valid | Low | | Valid test key | Valid | Info | | Secret is invalid or has insufficient permissions (`401` or `403`) | Invalid | Info | | Validation cannot complete because the service is unreachable, rate-limited, or returns a `5xx` response | None | Unknown |
Flutterwave Secret Key | Live validation result | Validation type | Risk | | -------------------------------------------------------------------------------------------------------- | --------------- | -------- | | Valid key with access to live data | Valid | Critical | | Valid key that returns no data | Valid | High | | Valid key for an environment without subscriptions | Valid | Low | | Valid test key | Valid | Info | | Secret is invalid or has insufficient permissions (`401` or `403`) | Invalid | Info | | Validation cannot complete because the service is unreachable, rate-limited, or returns a `5xx` response | None | Unknown |
GCP Access Token | Live validation result | Validation type | Risk | | -------------------------------------------------------------------------------------------------------- | --------------- | -------- | | Valid token with `admin` or `full_control` scope | Valid | Critical | | Valid token without `admin` or `full_control` scope | Valid | High | | Secret is invalid or has insufficient permissions (`401` or `403`) | Invalid | Info | | Validation cannot complete because the service is unreachable, rate-limited, or returns a `5xx` response | None | Unknown |
GCP API key | Live validation result | Validation type | Risk | | -------------------------------------------------------------------------------------------------------- | --------------- | ------- | | Valid key with Gemini access | Valid | High | | Valid key without Gemini access | Valid | Low | | Secret is invalid or has insufficient permissions (`401` or `403`) | Invalid | Info | | Validation cannot complete because the service is unreachable, rate-limited, or returns a `5xx` response | None | Unknown |
GitHub App Token | Live validation result | Validation type | Risk | | -------------------------------------------------------------------------------------------------------- | --------------- | ------- | | Valid token with full access | Valid | High | | Valid token restricted by SSO, an IP allow-list, or limited permissions | Valid | Medium | | Secret is invalid or has insufficient permissions (`401` or `403`) | Invalid | Info | | Validation cannot complete because the service is unreachable, rate-limited, or returns a `5xx` response | None | Unknown |
GitHub Fine-Grained Personal Access Token | Live validation result | Validation type | Risk | | -------------------------------------------------------------------------------------------------------- | --------------- | ------- | | Valid token with full access | Valid | High | | Valid token with restricted access | Valid | Medium | | Secret is invalid or has insufficient permissions (`401` or `403`) | Invalid | Info | | Validation cannot complete because the service is unreachable, rate-limited, or returns a `5xx` response | None | Unknown |
GitHub OAuth Access Token | Live validation result | Validation type | Risk | | -------------------------------------------------------------------------------------------------------- | --------------- | ------- | | Valid token with full access | Valid | High | | Valid token with restricted access | Valid | Medium | | Secret is invalid or has insufficient permissions (`401` or `403`) | Invalid | Info | | Validation cannot complete because the service is unreachable, rate-limited, or returns a `5xx` response | None | Unknown |
GitHub Personal Access Token | Live validation result | Validation type | Risk | | -------------------------------------------------------------------------------------------------------- | --------------- | ------- | | Valid token with full access | Valid | High | | Valid token with restricted access | Valid | Medium | | Secret is invalid or has insufficient permissions (`401` or `403`) | Invalid | Info | | Validation cannot complete because the service is unreachable, rate-limited, or returns a `5xx` response | None | Unknown |
GitHub Refresh Token | Live validation result | Validation type | Risk | | -------------------------------------------------------------------------------------------------------- | --------------- | ------- | | Valid token with full access | Valid | High | | Valid token with restricted access | Valid | Medium | | Secret is invalid or has insufficient permissions (`401` or `403`) | Invalid | Info | | Validation cannot complete because the service is unreachable, rate-limited, or returns a `5xx` response | None | Unknown |
JFrog Artifactory | Live validation result | Validation type | Risk | | -------------------------------------------------------------------------------------------------------- | --------------- | -------- | | Valid token | Valid | Critical | | Secret is invalid or has insufficient permissions (`401` or `403`) | Invalid | Info | | Validation cannot complete because the service is unreachable, rate-limited, or returns a `5xx` response | None | Unknown |
JSON Web Token | Live validation result | Validation type | Risk | | -------------------------------------------------------------------------------------------------------- | --------------- | -------------- | | Token verified by its claims and signature | Valid | High or Medium | | Token matches test-data patterns | Valid | Info | | Secret is invalid or has insufficient permissions (`401` or `403`) | Invalid | Info | | Validation cannot complete because the service is unreachable, rate-limited, or returns a `5xx` response | None | Unknown |
Mailgun private API token | Live validation result | Validation type | Risk | | -------------------------------------------------------------------------------------------------------- | --------------- | ------- | | Valid key | Valid | Medium | | Secret is invalid or has insufficient permissions (`401` or `403`) | Invalid | Info | | Validation cannot complete because the service is unreachable, rate-limited, or returns a `5xx` response | None | Unknown |
New Relic API Key | Live validation result | Validation type | Risk | | -------------------------------------------------------------------------------------------------------- | --------------- | ------- | | Valid key with access to live applications | Valid | High | | Valid key with no applications found | Valid | Low | | Secret is invalid or has insufficient permissions (`401` or `403`) | Invalid | Info | | Validation cannot complete because the service is unreachable, rate-limited, or returns a `5xx` response | None | Unknown |
Npm Access Token | Live validation result | Validation type | Risk | | -------------------------------------------------------------------------------------------------------- | --------------- | ------- | | Valid token with package access | Valid | High | | Valid token for a demo or test user, an account without packages, or an IP-restricted account | Valid | Low | | Secret is invalid or has insufficient permissions (`401` or `403`) | Invalid | Info | | Validation cannot complete because the service is unreachable, rate-limited, or returns a `5xx` response | None | Unknown |
OpenAI API Key | Live validation result | Validation type | Risk | | -------------------------------------------------------------------------------------------------------- | --------------- | ------- | | Valid key | Valid | High | | Secret is invalid or has insufficient permissions (`401` or `403`) | Invalid | Info | | Validation cannot complete because the service is unreachable, rate-limited, or returns a `5xx` response | None | Unknown |
Private Key | Live validation result | Validation type | Risk | | -------------------------------------------------------------------------------------------------------- | --------------- | ------- | | Passwordless private key or key with a successfully brute-forced passphrase | Valid | High | | Passphrase-protected or encrypted private key | Valid | Medium | | Certificate | Valid | Low | | Secret is invalid or has insufficient permissions (`401` or `403`) | Invalid | Info | | Validation cannot complete because the service is unreachable, rate-limited, or returns a `5xx` response | None | Unknown |
SendGrid API token | Live validation result | Validation type | Risk | | -------------------------------------------------------------------------------------------------------- | --------------- | ------- | | Valid token | Valid | Medium | | Secret is invalid or has insufficient permissions (`401` or `403`) | Invalid | Info | | Validation cannot complete because the service is unreachable, rate-limited, or returns a `5xx` response | None | Unknown |
Slack Bot token | Live validation result | Validation type | Risk | | -------------------------------------------------------------------------------------------------------- | --------------- | ------- | | Valid token | Valid | Low | | Secret is invalid or has insufficient permissions (`401` or `403`) | Invalid | Info | | Validation cannot complete because the service is unreachable, rate-limited, or returns a `5xx` response | None | Unknown |
Stripe API Token | Live validation result | Validation type | Risk | | -------------------------------------------------------------------------------------------------------- | --------------- | -------- | | Valid token with access to live data | Valid | Critical | | Valid token that returns no data | Valid | High | | Valid token with access to test data only | Valid | Info | | Secret is invalid or has insufficient permissions (`401` or `403`) | Invalid | Info | | Validation cannot complete because the service is unreachable, rate-limited, or returns a `5xx` response | None | Unknown |
### Excluded secrets and paths False positive hardcoded secrets tend to be identified in many forked repositories, known test paths and file names. Arnica includes pre-defined excluded paths and file names that are skipped in the detection and issue creation process. These files and paths can be configured or deleted in the [policies page](https://app.arnica.io/#/admin/policy-v2) under the secrets configurations section. ## Detection scope and scan timing Arnica identifies hardcoded secrets through: * **Real-time push scanning** for newly introduced commits on monitored branches. * **Scheduled scans** for broader repository coverage and status reconciliation. {% hint style="info" %} Secrets that exist only in local, unpushed branches are not visible to Arnica until pushed to the integrated SCM. {% endhint %} ## Troubleshooting common outcomes ### Secret was committed but does not appear If a leaked secret is not visible: 1. Confirm the commit was pushed to a repository and branch covered by the integration. 2. Confirm the file path is not excluded in **Secrets Policy Settings**. 3. Confirm enough time has passed for the relevant scan cycle (real-time push event or routine scan). ### Secret was fixed but finding still appears open Finding status is reconciled after a subsequent scan observes the updated file state. 1. Verify the remediation is committed to the relevant monitored branch. 2. Wait for the next routine scan if no new push event occurs. 3. Re-check the finding after the next processing cycle. ### Large historical false-positive backlog For bulk cleanup (for example, generated archives or crawled content), keep ignore rules in place to prevent new noise and dismiss existing findings in bulk using the API. {% hint style="info" %} Use the Arnica API reference for bulk finding workflows: [Arnica API Swagger](https://api.app.arnica.io/swagger). {% endhint %}