Secrets detection

Vulkro finds hardcoded API keys, tokens, passwords, connection strings and private keys in your code, config files and git history.

vulkro scan .                       # secrets are part of every scan
vulkro scan . --validate-secrets    # opt in: check whether each key still works

Where it looks

• .env* files (kept even with --scope src)
• Source code in every supported language
• Config files (*.yaml, *.yml, *.toml, *.json)
• Terraform, Helm and Kubernetes manifests
• Git history: up to the last 500 commits within the last two years

A secret removed from the working tree still lives in git history, so the history audit reports it with the commit that added it. Secrets committed and later added to .gitignore are still found.

Provider formats

A generic api_key = "..." match starts at Medium confidence. A value that matches a known provider format is raised to High:

Format	Provider
sk_live_*	Stripe live key
AKIA*	AWS access key
ghp_*, gho_*, ghu_*, ghs_*	GitHub token
xoxb-*, xoxa-*, xoxp-*	Slack token
SG.*	SendGrid
hf_*	Hugging Face
glpat-*	GitLab personal access token

Live validation

--validate-secrets makes a harmless authenticated call to the provider for each secret. This is the only part of secrets scanning that uses the network, and it is off by default.

Tag	Meaning
[live]	The key works now. Severity is raised to Critical.
[dormant]	The provider rejected it (401 or 403), so it was probably rotated.
[unknown]	No check is available for this provider, or the call failed.

Suppressing a test value

# vulkro:disable-next-line
TEST_API_KEY = "sk_test_FAKE"

See Suppressions for every form.

See also: Confidence model