Secrets AutoTriage Denoising
Secrets AutoTriage reduces noise from secrets scanning so you can focus on exposed secrets that are actually dangerous. It does this by first trying to rule out false positives, and then, when a finding is real, ranking it by how risky the exposed secret is.
Secrets AutoTriage works on the secrets Aikido detects in your code. It doesn't change what gets scanned, only how findings are filtered and prioritized. This functionality is only available for Pro and Advanced Plans.
Enabling Secrets AutoTriage
Secrets AutoTriage is not enabled by default. Only workspace admins can turns it on from the workspace settings.
What Secrets AutoTriage is (and isn't)
Secrets AutoTriage isn't itself a scanner. It sits downstream of your secrets scans and makes determinations about whether a match is a real, exposed secret and, if so, how risky that exposure is.
For the majority of findings, Aikido triages based on Aikido-defined rules and validity checks. For more ambiguous cases, Aikido uses the surrounding code context to decide whether a match is a genuine secret or a placeholder, example, or test value.
How Secrets AutoTriage works
False positive filtering before triage
Before a secret reaches your feed, Aikido filters out matches that look like secrets but aren't. That may include:
Skipping test files, mock data, and example configurations
Recognizing placeholder and example values that share the format of a real secret
Applying your workspace Secret Keyword Filter to drop lines with known-safe keywords
Honoring code comment exclusions and
.aikidofile exclusions
These steps alone suppress a significant portion of secret alerts.
Some legitimate-looking secrets can't be distinguished from real ones by pattern alone. When in doubt, Aikido keeps the finding so you can review it rather than hiding a real exposure.
Validity and permission checks
When a match looks like a real secret, Aikido's Live Secret Detection verifies whether the secret is still active and inspects the scope of access it grants. AutoTriage uses these signals to adjust priority:
Expired or rotated secrets are downgraded, since they no longer pose a risk
Read-only scopes are prioritized lower than write or delete access
Active secrets with write/delete scopes are upgraded for immediate action
Signals Secrets AutoTriage considers
Secrets AutoTriage is context-hungry by design. In practice, it considers things like:
Whether the match is active, expired, or already rotated
The scope of permissions an active secret grants
Whether the file is a test, mock, example, or documentation file versus production code
Whether the value is a placeholder or example rather than a real credential
The sensitivity of the systems the secret unlocks
Resolving triaged secrets
Once a secret is confirmed as a real exposure, rotate it as soon as possible. Removing the secret from your code isn't enough on its own, since it remains in your git history. For guidance on cleaning up and rotating exposed secrets, see Resolving Malware and Leaked Secret Issues.
If AutoTriage flags something you believe is a false positive, you can ignore the issue in the UI, ignore it via a code comment, or add a workspace-wide Secret Keyword Filter.
Last updated
Was this helpful?