Secret Scanning
Secret scanning that finds the credential and the exact line
Connect a GitHub repo and TurboPentest scans your source with Gitleaks and the Opengrep secrets rule pack to detect hardcoded API keys, tokens, and private keys - each reported with the exact file and line, then validated by an AI agent. Not just a scan. A pentest.
See a sample report →What is secret scanning?
Secret scanning is the practice of searching your source code for hardcoded secrets - credentials that were never meant to live in the repository. API keys, database passwords, OAuth tokens, and private keys routinely get committed by accident, and once they're in version control they're exposed to anyone with read access and preserved forever in history. Secrets detection reads the code directly, so it pinpoints the exact file and line - turning remediation into a concrete task: rotate the key, remove it from source, and move it to a secret manager.
The catch with most secret scanners is noise: high-entropy strings and test fixtures that trigger false alarms. TurboPentest pairs two engines - Gitleaks and the Opengrep secrets and API-key rules - with an AI agent that validates each candidate finding, so you get a short list of confirmed hardcoded credentials, each with remediation and a Fix with AI prompt.
2 engines
Gitleaks plus the Opengrep secrets and API-key rule pack, run together
TurboPentest white-box
File + line
every hardcoded credential flagged with its exact location in source
Source-code analysis
AI-validated
Paladin validates each candidate finding to cut false positives
Paladin AI
How secret scanning runs on TurboPentest
Connect your GitHub repo (read-only)
White-box mode turns on the source-code layer. Black-box testing still runs against your live app at the same time.
Gitleaks + Opengrep secrets rules scan
Both engines sweep your source for hardcoded API keys, credentials, tokens, and private keys - each match flagged with the exact file and line.
Paladin AI validates
The AI confirms each candidate finding and drops false positives, so you get real leaked credentials instead of raw scanner noise.
Get your report with file + line
Confirmed secrets with their exact file-and-line locations, remediation guidance, and retest commands to confirm the fix landed.
Types of secrets we detect
Every rule is documented on the public Security Checks catalog with vulnerable-vs-safe code examples and CWE/OWASP/ASVS mappings.
API keys
Cloud, SaaS, and third-party service API keys hardcoded into source or config - flagged with the exact file and line so you know precisely what to rotate.
Database credentials
Connection strings and passwords for databases left in code, environment files, or committed configuration.
Private keys
SSH keys, TLS/PEM private keys, and signing keys committed to the repository - the kind of exposure that compromises everything downstream.
Tokens
OAuth tokens, session tokens, JWT signing secrets, and personal access tokens sitting in plaintext in your history.
Cloud keys
AWS, Azure, and GCP access keys and service-account credentials - a single leaked pair can open your entire cloud account.
Secret scanning is one layer of the white-box pass
When you connect a repo, TurboPentest runs secret scanning alongside SAST source-code analysis and Grype software composition analysis - all in the same white-box run, for the same $99 per target.
Secret scanning FAQ
What is secret scanning?+
Secret scanning analyzes your source code to detect hardcoded secrets - API keys, database credentials, tokens, and private keys - that were committed into the repository. Because it reads the code directly, it reports the exact file and line where each secret lives, so you know precisely what to rotate and remove.
How does TurboPentest detect hardcoded secrets?+
When you connect a GitHub repo read-only, TurboPentest runs Gitleaks plus the Opengrep rule pack's secrets and API-key rules across your source. Together they detect hardcoded credentials, tokens, and private keys, each flagged with the exact file and line. Then the Paladin AI validates every candidate finding so you get confirmed results, not a wall of raw scanner output.
Do you need access to my repository?+
Secret scanning runs in white-box mode, which turns on when you connect a GitHub repository read-only. Black-box testing still runs against your live target at the same time, so a single run covers both.
Where can I see what secret scanning checks for?+
Every rule is documented on the public Security Checks catalog, one indexed page per rule with CWE, OWASP, and ASVS mappings, vulnerable-vs-safe code examples, and remediation guidance.
How much does secret scanning cost?+
$99 per target, flat. Secret scanning is included in the white-box run at no extra charge when you connect a repo - alongside SAST source-code analysis and Grype software composition analysis.
Find your leaked secrets. $99.
Connect a repo and get white-box secret scanning plus a live pentest in one run. See pricing
Written and reviewed by
Michel Chamberland - Founder & CEO, IntegSec
CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security
Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.