> For the complete documentation index, see [llms.txt](https://help.aikido.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.aikido.dev/aikido-device-protection/using-aikido-endpoint/secret-scanning.md).
# Secret Scanning
Secret Scanning finds hardcoded secrets that have been left behind in local files on your team's devices, such as shell history files (`.zsh_history`, `.bash_history`), and helps you clean them up. It's easy to accidentally leak an API key or token into your shell history by pasting a `curl` command or an environment variable, and those secrets can sit there for months.
The scan runs entirely on the device. It surfaces every finding so a developer can review it and remediate it directly on their own machine.
{% hint style="info" %}
Secret Scanning is part of Aikido Device Protection. If you haven't deployed the agent yet, see [Deploying Device Protection](/aikido-device-protection/deploying-aikido-endpoint.md).
{% endhint %}
## How it works
Secret Scanning is designed so that your secrets never leave the device.
* **Scanning is fully local.** The agent reads and inspects files on the device itself. File contents are never uploaded to Aikido.
* **Secret values stay on the device.** The full value of a detected secret is never transmitted. In the desktop client it is shown masked (for example `[AIK********...]`) so you can recognize it without exposing it.
* **Only the secret type is reported.** Aikido receives the *type* of secret that was found (for example "authorization token"), never the value itself. This gives your organization visibility into what kinds of secrets are being exposed, without ever seeing the secrets.
```mermaid
flowchart LR
A[Files on device e.g. .zsh_history] --> B[On-device scan]
B --> C[Findings shown locally file, type, masked preview]
B --> D[Secret type only reported to Aikido]
classDef local fill:#d6f5d6,stroke:#27ae60;
classDef cloud fill:#fff2cc,stroke:#e1a100;
class C local;
class D cloud;
```
## Reviewing detected secrets
Open the **Secrets** tab in the desktop client to see everything the agent has found. The tab shows a count of the total number of secrets detected.
Each finding shows:
* **Type** - A description of what was detected, for example "Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource."
* **Location** - The file and line where the secret was found, for example `/Users/samuel/.zsh_history:370`. When the same type of secret appears in multiple places, they are grouped together (for example, "and 8 more"). Expand the row to see every occurrence.
* **Value** - The detected secret, always masked.
## Cleaning up secrets
You can remediate secrets one at a time or in bulk.
* **One by one** - Click the **erase** icon on a finding to clean that individual secret.
* **In bulk** - Use the checkboxes to select multiple findings, or select all secrets of a specific type, then clean them in a single action.
Cleaning removes the secret from the file on the device.
{% hint style="warning" %}
Cleaning a secret only removes it from the local file. If the secret is still valid, rotate or revoke it at its source so it can no longer be used.
{% endhint %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://help.aikido.dev/aikido-device-protection/using-aikido-endpoint/secret-scanning.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.