Secrets
What is Secret Scanning?
Also known as: Secret Detection · Credential Scanning · 시크릿 스캐닝 · 시크릿 탐지 · 크리덴셜 스캐닝 · 시크릿 검출
Secret scanning searches connected code, documents, messages or storage for exposed credentials and other secrets. A match is a lead to investigate, not proof that a credential works or was misused. Some credential types support issuer-side validity checks; others need manual review. Cremit scans configured sources such as repositories and collaboration tools, while eligible external discoveries can be monitored unless excluded, subject to organization settings.
More terms in Secrets
- CredentialA credential is information a system accepts to authenticate an identity or authorize access. Examples include passwords, API keys, access tokens and private keys used in authentication. A secret is information that must be kept confidential; the terms overlap, but not every secret is a credential, and a JWT is a credential only when a service accepts it for access.
- Secret SprawlSecret sprawl is the spread of credentials and other secrets across repositories, CI settings, documents and messages without a reliable inventory or owner. When a credential must be replaced, the team needs to find every system that uses the value and every copy that could expose it. The number of copies does not by itself show what the credential can access.
- Credential LeakageCredential leakage means a password, key or token became available outside its intended access boundary, for example through a public commit, log or client-side bundle. A scanner may find an old exposure; the finding alone does not prove the credential is still valid or was used. Record the evidence, check validity and access, contain a live exposed credential promptly, and review available issuer logs.