Secrets

Credentials in your code, your configuration, and your git history.

Around 1,090 detection rules for credential shapes: cloud provider keys, personal access tokens, API keys for hundreds of services, private keys, database connection strings, JWTs, and high-entropy strings that look like secrets even when the format is unfamiliar.

When it runs

On save, not on every keystroke. This is a deliberate trade-off with a measurement behind it.

Secret rules are the majority of the rule set, and each one examines every file. Evaluating a single file against everything costs about 231 ms; against everything except secrets, 10 ms. Running them on each keystroke would make the editor feel slow, to detect a credential that cannot be complete until you have stopped typing it.

Set vulnetix.secrets.onType to true if you disagree; the measurement is on performance so you can decide with the numbers in front of you.

Git history

A secret removed in a later commit is still in the repository, and still needs rotating. History scanning is available but off by default in the editor, because walking hundreds of commits is not something to do while someone is typing.

Run Vulnetix: Scan Workspace with vulnetix.secrets.gitHistory enabled, or scan history from the CLI, which is the better place for it.

Beyond source files

Secrets are also extracted from strings inside compiled binaries, from image metadata, and from base64-encoded Kubernetes Secret values, which are decoded before matching. A base64 blob is not encryption and is not treated as such.

When it finds something real

Rotate first. Removing the commit does not help: assume anything pushed has been harvested. Rotate the credential, then clean the history if you still want to.

The finding links to the provider’s rotation documentation where we have it.

False positives

Test fixtures and documentation examples trip detectors, which is why example keys exist. Suppress with a nosec comment for a one-off, or with Vulnetix: Suppress for something recurring that your team should be able to see the reasoning for.