Source Code Secret Detection
Secret Detection Overview
Secret detection is the process of identifying sensitive information related to your organisation that may be unintentionally exposed on platforms like GitHub or DockerHub.
We scan all GitHub, DockerHub, and Pastes events that Flare finds using a set of rules designed to detect patterns that match known secret formats. The types of secrets we look for are listed below. They are also suggested by the Search Query Assistant as you build such a query.
Generic vs. Non-Generic Secrets
Some secrets are classified as generic. These are common patterns that can easily trigger false positives, making them noisier and less reliable indicators of a real leak. Because of this, events are scored differently depending on whether the detected secrets are generic or not.
- Non-Generic Secrets — If we detect one or more non-generic secrets in an event, we raise its score to indicate greater risk.
- Only Generic Secrets — If all detected secrets are generic, we lower the event’s score to reduce unnecessary alerts.
This approach helps prioritise real threats while minimising noise from harmless matches.
Querying for secrets
“I want to find all Flare events that contain secrets”
How to do it:
Source Filtering: Restrict your search to Source Code by specifying the source.
Query: contains_secrets:true
Dive deeper: you can specify which source you want to explore using metadata.source:dockerhub or metadata.source:driller_github
“I want to find all Flare events that contain a certain secret”
How to do it:
Source Filtering: Restrict your search to Source Code by specifying the source.
Query: secrets_metadata.type:[Select from list below]
Dive deeper: you can specify which source you want to explore using metadata.source:dockerhub or metadata.source:driller_github
Secret types
Type | Description |
|---|---|
adafruit_io_key | Adafruit IO Key |
adobe_oauth_client_secret | Adobe OAuth Client Secret |
age_recipient_x25519_public_key | Age Recipient (X25519 public key) |
age_identity_x22519_secret_key | Age Identity (X22519 secret key) |
anthropic_api_key | Anthropic API Key |
aws_appsync_api_key | AWS AppSync API Key |
amazon_resource_name | Amazon Resource Name |
artifactory_api_key | Artifactory API Key |
auth0_application_credentials | Auth0 Application Credentials |
aws_api_key | AWS API Key |
aws_secret_access_key | AWS Secret Access Key |
aws_account_id | AWS Account ID |
aws_session_token | AWS Session Token |
amazon_mws_auth_token | Amazon MWS Auth Token |
aws_api_credentials | AWS API Credentials |
azure_connection_string | Azure Connection String |
azure_app_configuration_connection_string | Azure App Configuration Connection String |
azure_personal_access_token | Azure Personal Access Token |
bitbucket_app_password | Bitbucket App Password |
blynk_device_access_token | Blynk Device Access Token |
blynk_organization_access_token | Blynk Organization Access Token |
blynk_organization_client_credentials | Blynk Organization Client Credentials |
codeclimate_reporter_id | CodeClimate Reporter ID |
crates_io_api_key | crates.io API Key |
databricks_personal_access_token | Databricks Personal Access Token |
digitalocean_application_access_token | DigitalOcean Application Access Token |
digitalocean_personal_access_token | DigitalOcean Personal Access Token |
digitalocean_refresh_token | DigitalOcean Refresh Token |
django_secret_key | Django Secret Key |
docker_hub_personal_access_token | Docker Hub Personal Access Token |
doppler_cli_token | Doppler CLI Token |
doppler_personal_token | Doppler Personal Token |
doppler_service_token | Doppler Service Token |
doppler_service_account_token | Doppler Service Account Token |
doppler_scim_token | Doppler SCIM Token |
doppler_audit_token | Doppler Audit Token |
dropbox_access_token | Dropbox Access Token |
dependency_track_api_key | Dependency-Track API Key |
dynatrace_token | Dynatrace Token |
facebook_secret_key | Facebook Secret Key |
facebook_access_token | Facebook Access Token |
figma_personal_access_token | Figma Personal Access Token |
firecrawl_api_key | Firecrawl API Key |
google_cloud_storage_bucket | Google Cloud Storage Bucket |
generic_secret | Generic Secret |
connection_string_in_net_configuration | Connection String in .NET Configuration |
generic_password | Generic Password |
generic_username_and_password | Generic Username and Password |
generic_api_key | Generic API Key |
credentials_in_net_system_net_networkcredential | Credentials in .NET System.Net.NetworkCredential |
credentials_in_net_system_directoryservices_directoryentry | Credentials in .NET System.DirectoryServices.DirectoryEntry |
sensitive_value_in_net_configuration | Sensitive Value in .NET Configuration |
gitalk_oauth_credentials | Gitalk OAuth Credentials |
github_personal_access_token | GitHub Personal Access Token |
github_oauth_access_token | GitHub OAuth Access Token |
github_app_token | GitHub App Token |
github_refresh_token | GitHub Refresh Token |
github_client_id | GitHub Client ID |
github_secret_key | GitHub Secret Key |
gitlab_runner_registration_token | GitLab Runner Registration Token |
gitlab_personal_access_token | GitLab Personal Access Token |
gitlab_pipeline_trigger_token | GitLab Pipeline Trigger Token |
google_client_id | Google Client ID |
google_oauth_client_secret | Google OAuth Client Secret |
google_oauth_access_token | Google OAuth Access Token |
google_api_key | Google API Key |
google_oauth_credentials | Google OAuth Credentials |
hardcoded_gradle_credentials | Hardcoded Gradle Credentials |
grafana_api_token | Grafana API Token |
grafana_cloud_api_token | Grafana Cloud API Token |
grafana_service_account_token | Grafana Service Account Token |
groq_api_key | Groq API Key |
hashicorp_vault_service_token | Hashicorp Vault Service Token |
hashicorp_vault_batch_token | Hashicorp Vault Batch Token |
hashicorp_vault_recovery_token | Hashicorp Vault Recovery Token |
hashicorp_vault_unseal_key | Hashicorp Vault Unseal Key |
heroku_api_key | Heroku API Key |
http_basic_authentication | HTTP Basic Authentication |
http_bearer_token | HTTP Bearer Token |
huggingface_user_access_token | HuggingFace User Access Token |
jenkins_token_or_crumb | Jenkins Token or Crumb |
jenkins_setup_admin_password | Jenkins Setup Admin Password |
jina_search_foundation_api_key | Jina Search Foundation API Key |
json_web_token_secret | JSON Web Token Secret |
kagi_api_key | Kagi API Key |
password_hash_kerberos | Password Hash (Kerberos 5, etype 23, AS-REP) |
kubernetes_bootstrap_token | Kubernetes Bootstrap Token |
linkedin_client_id | LinkedIn Client ID |
linkedin_secret_key | LinkedIn Secret Key |
mailchimp_api_key | MailChimp API Key |
mailgun_api_key | Mailgun API Key |
mapbox_public_access_token | Mapbox Public Access Token |
mapbox_secret_access_token | Mapbox Secret Access Token |
mapbox_temporary_access_token | Mapbox Temporary Access Token |
credentials_in_mongodb_connection_string | Credentials in MongoDB Connection String |
microsoft_teams_webhook | Microsoft Teams Webhook |
netrc_credentials | netrc Credentials |
new_relic_license_key | New Relic License Key |
new_relic_api_service_key | New Relic API Service Key |
new_relic_admin_api_key | New Relic Admin API Key |
new_relic_insights_insert_key | New Relic Insights Insert Key |
new_relic_insights_query_key | New Relic Insights Query Key |
new_relic_rest_api_key | New Relic REST API Key |
new_relic_pixie_api_key | New Relic Pixie API Key |
new_relic_pixie_deploy_key | New Relic Pixie Deploy Key |
npm_access_token | NPM Access Token (fine-grained) |
nuget_api_key | NuGet API Key |
credentials_in_odbc_connection_string | Credentials in ODBC Connection String |
okta_api_token | Okta API Token |
openai_api_key | OpenAI API Key |
particle_io_access_token | particle.io Access Token |
pem_encoded_private_key | PEM-Encoded Private Key |
phpmailer_credentials | PHPMailer Credentials |
credentials_in_postgresql_connection_uri | Credentials in PostgreSQL Connection URI |
postman_api_key | Postman API Key |
postmark_api_token | Postmark API Token |
credentials_in_psexec_invocation | Credentials in PsExec Invocation |
password_hash_md5crypt | Password Hash (md5crypt) |
password_hash_bcrypt | Password Hash (bcrypt) |
password_hash_sha256crypt | Password Hash (sha256crypt) |
password_hash_sha512crypt | Password Hash (sha512crypt) |
password_hash_cisco_ios_pbkdf2_with_sha256 | Password Hash (Cisco IOS PBKDF2 with SHA256) |
pypi_upload_token | PyPI Upload Token |
react_app_username | React App Username |
react_app_password | React App Password |
rubygems_api_key | RubyGems API Key |
aws_s3_bucket | AWS S3 Bucket |
salesforce_access_token | Salesforce Access Token |
sauce_token | Sauce Token |
segment_public_api_token | Segment Public API Token |
sendgrid_api_key | SendGrid API Key |
shopify_domain | Shopify Domain |
shopify_app_secret | Shopify App Secret |
shopify_access_token | Shopify Access Token |
slack_bot_token | Slack Bot Token |
slack_webhook | Slack Webhook |
slack_user_token | Slack User Token |
slack_app_token | Slack App Token |
slack_legacy_bot_token | Slack Legacy Bot Token |
sonarqube_token | SonarQube Token |
sourcegraph_access_token | Sourcegraph Access Token |
square_access_token | Square Access Token |
square_oauth_secret | Square OAuth Secret |
stackhawk_api_key | StackHawk API Key |
stripe_api_key | Stripe API Key |
stripe_api_test_key | Stripe API Test Key |
tavily_api_key | Tavily API Key |
teamcity_api_token | TeamCity API Token |
telegram_bot_token | Telegram Bot Token |
thingsboard_access_token | ThingsBoard Access Token |
thingsboard_provision_device_key | ThingsBoard Provision Device Key |
thingsboard_provision_device_secret | ThingsBoard Provision Device Secret |
truenas_api_key_websocket | TrueNAS API Key (WebSocket) |
truenas_api_key_rest_api | TrueNAS API Key (REST API) |
twilio_api_key | Twilio API Key |
twitter_client_id | Twitter Client ID |
twitter_secret_key | Twitter Secret Key |
credentials_in_connect_viserver_invocation | Credentials in Connect-VIServer Invocation |
wireguard_private_key | WireGuard Private Key |
wireguard_preshared_key | WireGuard Preshared Key |