Get started

Overview

Security tools

SAST
SCA

Integrations

Reference

Glossary

Advanced usage

CLI

/Vulnerability documentation/Secrets

Secrets

This section collects documentation about secret exposure and remediation.

Documentation

Overall response principles and guidance by situation: Overview
Secrets in configuration files: Configuration files
Applications that need runtime configuration files: Runtime configuration files
Kubernetes operations: Kubernetes
CI/CD operations: CI/CD
Vault and secret manager operations: Vault and secret managers
Examples
- Go services: Go config.yaml example
- Spring Boot: Spring application.yml example

Related pages7

Secrets

Credentials, API keys, access tokens, secret keys and certificate private keys stored in source code can leak through repository access, log collection, build artifacts or image layers.

Secrets in configuration files

Secrets in runtime configuration files

Secrets in CI/CD

Secrets embedded in deployment scripts, GitHub Actions workflows, GitLab CI configuration or Jenkinsfiles can leak through both the repository and build logs.

Secrets in Vault or Secret Manager

If your organization already uses a central secret store such as Vault, AWS Secrets Manager, Google Secret Manager, or Azure Key Vault, move secrets out of code and retrieve or inject them at runtime.