Secret detection
On this page
Secret detection reviews authorized source code and project artifacts for patterns that may indicate credentials, tokens, or sensitive configuration values. A match does not prove that a credential is still active.
#Inputs
Include the approved project source and relevant configuration in the Workbench assessment. Detection is limited to the material you provide. The assessment does not expand authorization to third-party systems or authorize calling a provider API to validate a value.
#What results mean
A result identifies a possible secret pattern in project material. Review its file and project context with the credential owner before deciding whether it is a real, usable credential. Do not treat a match alone as proof of exposure or active access.
#Review and remediation
Treat suspected values as restricted evidence. Share only what is needed for triage; do not paste the value into tickets, chat, or public reports. If the team confirms a live credential, revoke or rotate it and remove it from the relevant source before reviewing the project again.
#Availability
Secret detection is included in the Professional package. See Plans and licensing for package details. Access is arranged by email; request access.
#Related guides
Need a workflow that is not documented here? Email contact@eresussec.com.