Secret Scanning
: An automated security practice that scans source code, git history, configuration files, and CI/CD pipelines for accidentally committed secrets such as API keys, passwords, tokens, private keys, and database connection strings. Secret scanners use pattern matching, entropy analysis, and known secret formats to detect credentials before they reach production.
Why It Matters for AI-Coded Apps
AI-generated code is notorious for including hardcoded secrets. When vibe coding, LLMs generate placeholder API keys, database URLs with embedded credentials, and example tokens that developers forget to replace before committing. A single committed secret can compromise your entire infrastructure.
Real-World Example
A developer prompts the AI to build a Stripe integration. The generated code includes const STRIPE_KEY = 'sk_live_abc123...' as a placeholder. The developer commits this to GitHub. Within minutes, automated bots scanning public repos find and exploit the key, making fraudulent charges.
How to Detect and Prevent It
Enable GitHub secret scanning (free for public repos, paid for private). Use pre-commit hooks with tools like TruffleHog or detect-secrets to block commits containing secrets. Store secrets in environment variables or secret management services (AWS Secrets Manager, Vault). Add secret patterns to .gitignore. Regularly scan git history for historical leaks.
Frequently Asked Questions
What happens if I accidentally commit a secret?
Rotating the secret is mandatory – even if you remove it from the code, it remains in git history. Revoke the old secret immediately, generate a new one, and store it properly. Use git filter-branch or BFG Repo Cleaner to remove it from history if the repo is public.
What tools detect secrets in code?
GitHub Secret Scanning (built-in), GitGuardian (comprehensive, free for individuals), TruffleHog (open-source, scans git history), detect-secrets (Yelp’s pre-commit tool), and Gitleaks (open-source, CI/CD integration). Most can run as pre-commit hooks and in CI/CD pipelines.
Does .gitignore prevent secret leaks?
.gitignore prevents files from being tracked, but it does not protect secrets hardcoded directly in source files. Always use environment variables for secrets and add .env to .gitignore. Secret scanning catches secrets that slip through despite .gitignore protections.
Scan your app for security issues automatically
Vibe Eval checks for 200+ vulnerabilities in AI-generated code.
Try Vibe Eval