Secrets

The secrets scanner looks for credentials accidentally committed to source.

​

What it catches

Detection uses TigerGate’s secrets engine with a built-in ruleset (150+ credential detectors), plus a generic entropy detector for formats without a dedicated rule.

​

How findings are produced

1. Pattern match — regex against known credential formats (e.g. AKIA[0-9A-Z]{16} for an AWS access key).
2. Entropy — Shannon entropy on the matched string; a very high-entropy value escalates the finding’s severity.
3. Liveness verification — for supported issuers (GitHub, GitLab, Slack, Stripe, npm), TigerGate makes a single read-only identity call to confirm whether the credential is still active. The check runs at scan time and the secret value is never persisted — only the verdict (active / inactive / unknown). A confirmed-active secret is a true positive.

Severity is assigned from the kind of secret matched:

• CRITICAL — cloud provider keys (AWS / GCP / Azure), private keys, database credentials, Stripe secret keys
• HIGH — API tokens, generic API keys, passwords, and very-high-entropy strings
• MEDIUM — everything else

The matched value is redacted before it leaves the scanner — only the first and last few characters are kept. TigerGate never stores or logs the raw secret.

​

Suppressing false positives

Test files are full of fake-but-realistic keys. To suppress a match, open the finding in the dashboard, set its status to Muted or Accepted, and add a note. To skip whole paths (e.g. test fixtures) at scan time, use --exclude.

​

Running in CI

Secrets scanning runs on every CI scan — tigergate scan --type secrets, or as part of --type all — so a committed secret is caught on the pull request. Run the same scan as a local pre-commit step to block secrets before they reach git history.

​

What to do if a secret leaks

Treat rotation, not redaction, as the fix — a secret that was ever public is permanently compromised.

1. Revoke and rotate the credential at its provider.
2. Audit the provider’s access log for unauthorized use.
3. Purge from history if you want the value gone from old commits (e.g. with git filter-repo). Rotate first — purging alone does not make a leaked secret safe.