Secure Code Review and Application Security
Secrets Leak Scanning
We identify passwords, API keys and access tokens exposed in your code and repository history. We show what each one accesses and plan its replacement.
What it is
A password or cloud access key written into code remains in the repository history even if the line is deleted. Anyone or any system with a copy of the repository can access it. The scan therefore covers the entire history and build outputs, not just the current code. Deleting a valid key from the code is not enough; it must be replaced.
Scope
- Scanning all branches and the full commit history
- Container images, configuration files and CI/CD definitions
- For each value found, identifying which system it accesses and with what permissions
- Order and owners for rotating values that are still valid
- Controls that detect new leaks before commit and in the CI/CD pipeline
The need
When organizations need it
- When a repository is accidentally made public or a developer's laptop is lost.
- When you see unrecognized access in your cloud account or logs.
- When an audit requires you to show that no passwords are present in your source code.
Method
How we work
-
Scan
We scan all repositories and commit history with automated tools and review each result individually.
-
Impact
Together with system owners, we determine which system each value accesses and whether it is still valid.
-
Rotation
We define the order and responsible parties for replacing valid values without service interruption.
-
Prevention
We implement controls that detect new leaks before commit and in the CI/CD pipeline.
Outcome
What you have at the end
You have visibility into what every exposed password and key accesses and whether it has been replaced. When a new password is written into code, an alert is raised at commit or in the CI/CD pipeline.
Frequently asked questions
Is cleaning the repository history enough?
No. The value may remain in previously copied repositories and build outputs. Every valid key must be replaced.
Do you use the keys you find to access our systems?
No. A key's validity and permissions are determined from the system owner's console or by an identity check that does not read data, with the owner's approval.
Do the values found appear in the report?
Values appear in the report in masked form. The scan can run in your environment so your code and values do not leave the company.
Secure Code Review and Application Security
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting