Skip to main content

Secret Detection

Checkmarx Secret Detection reduces risk by quickly identifying sensitive credentials that may be exposed, enabling your development and security teams to quickly remove and change the discovered secrets.

Notice

Only accounts that have Purchased Solutions "SCS" and also "Enterprise Secrets" have access to the Secret Detection scanner.

Key Features

  • Powerful Secret Detection – Checkmarx identifies more than 210 different types of login credentials, access tokens, encryption keys, API keys, SSH keys, webhook URLs, and other unsecured sensitive information. 

  • Automatic Secret Validation – To prioritize remediation efforts, the system automatically attempts to determine if discovered secrets are still valid and operative. 

  • Automatic and Manual Scan Initiation – Scanning for exposed secrets can be initiated automatically at specific SDLC stages via SCM integration and on demand via integrated IDE, CLI, API, and the Checkmarx One UI.  

  • Developer-Friendly Workflows – Developers can initiate scans for exposed secrets, review results, and receive remediation guidance – all within their IDE.

  • Git Commit History - Scanning Git commit history helps you uncover secrets that were introduced in the past and may still pose a security or compliance risk today. It provides deeper visibility and stronger assurance that no exposed secrets are overlooked.

  • Confluence scans - Scanning Confluence spaces or pages helps you uncover secrets that may be exposed in your Confluence sites.

Secret Detection Rules

The following table shows the list of rules that are used to detect various types of secrets.

Note

If you need to customize or extend secret scanning beyond the default rules, use the Secret Detection Query Editor.

Running Scans

Secret Detection can be run on your Checkmarx One projects via web application, CLI or REST API. It is also possible to set up a code repository integration that automatically triggers a scan whenever a pull request or push event occurs in the SCM. You can also run scans directly from your IDE (currently supported for VS Code, Kiro, Windsurf, Cursor, JetBrains and Visual Studio).

In addition, you can create a project specifically to run a scan on a Confluence space using the REST API only. The scan results from the Confluence space are then loaded into the created project.

Learn more about running scans here.

In this section: