Scan

What Scan does

Deterministic pattern matching does the secret detection, because API keys and tokens have recognisable shapes and a model is the wrong instrument for a job that regular expressions do reliably. The AI assists only on logic vulnerabilities, where pattern matching genuinely cannot help. Detected secrets are always masked and never returned in full: a scanner that displayed the key it found would be creating the exposure it exists to prevent, and nothing sensitive is stored or transmitted.

• Secret detection with masked output
• Vulnerability pattern matching
• Optional AI logic-flaw assist
• Nothing sensitive stored or transmitted

How Scan works

1. Paste the code

   A file, a diff, a configuration block.

2. Run the deterministic detection

   Secrets have recognisable shapes, and pattern matching finds them reliably where a model would not.

3. Add the AI logic pass

   Only for logic vulnerabilities, where structural patterns cannot help.

4. Rotate anything it finds

   A secret that reached source control is compromised. Removing the line is not the fix; rotating the key is.

What Scan does not do

Scan reviews what you paste (no repository scanning, no git history, no CI integration), so a secret committed and later deleted is still in your history and will not be found here. Pattern matching finds known shapes and misses novel ones; the AI logic pass produces both false positives and false negatives. It is a useful check, not a security audit, and it does not replace a proper secrets-management practice.

Common questions

Does it scan my whole repository and git history?

No. It reviews what you paste. A secret that was committed and later removed still lives in your git history, and finding that needs a dedicated history scanner.

Why are detected secrets masked?

Because a scanner that displayed the key in full would be creating the exposure it exists to prevent. You need to know a secret is there and where; you do not need it echoed back.

What should I do when it finds one?

Rotate the key. Deleting the line is not sufficient: if the secret reached source control it should be treated as compromised regardless of what happened afterwards.