Azure Learning

secret-scanning

Properties2
tagsdevops, security, secrets, scanning, credentials
aliasessecret scanning, secrets scanning, credential scanning, leak detection, token detection

3 min read

Secret scanning

What it is

Secret scanning automatically detects hardcoded secrets — API keys, passwords, connection strings, OAuth tokens, private keys, certificates — in source code, commits, and build scripts, and flags/remediates them before they leak. It finds credentials committed by accident so a repository history doesn’t become a treasure chest for attackers.

Why it exists

Developers routinely paste a token to get something working and it ends up in a commit — and git history keeps it forever, even if the latest commit removes it. Scanning code (current state and full commit history) is the reliable way to catch leaked credentials, then revoke & rotate them, because a committed secret must be considered compromised regardless of deletion.

Key ideas

  • Content/text scanning — runs as a PR/build check to catch secrets in the code being authored.
  • History scanning — scans the full git history, not just HEAD, since old commits still contain the secret and bots mine them.
  • Patterns + entropy — detects by known key formats (e.g. sk-...), header shapes (Authorization: Bearer), and high-entropy strings.
  • What to do on a hit — revoke/rotate the credential, remove it from history (or treat history as compromised), and add it to an allow/ignore list if it’s a test fixture.
  • Secret about remediation — don’t just delete; push the fix, invalidate the token, and optionally surface to the owner.
  • Pair with secret storage — scanning pushes you to move secrets to a secure store (Azure Key Vault) into variables/references rather than hardcoding.

Example tools / services

GitHub secret scanning (built-in); Azure DevOps CredScan / advanced security secret scanning; open-source Gitleaks, TruffleHog, detect-secrets — runnable in CI as a gate.

How it fits

The credential-leak pillar of shift-left security: a compliance gate runs secret scanning on PR/build (and history) so secrets can’t slip into a shipped or force-pushed artifact. It complements SAST (which finds code flaws, not necessarily credentials) and the secure-CID path’s secret management.

Exam notes

  • Secret scanning = hardcoded credentials in code/history; on hit → revoke + rotate (never assume delete is enough, history persists).
  • Scan history as well as working tree — memorized trap (“it’s in an old commit”).
  • Tools: GitHub secret scanning, Azure DevOps **CredScan/**Advanced Security, Gitleaks, TruffleHog.
  • Best practice pairing: scan and store secrets in Key Vault/variables (secrets-management) so nothing sensitive lives in the repo.

dev-sec-ops · secrets-management · key-vault · compliance-gate · static-analysis

📘 Source: Microsoft Learn — Secret Scanning

Graph View

Backlinks