Secret Scanning

Secret Scanning finds hardcoded secrets that have been left behind in local files on your team's devices, such as shell history files (.zsh_history, .bash_history), and helps you clean them up. It's easy to accidentally leak an API key or token into your shell history by pasting a curl command or an environment variable, and those secrets can sit there for months.

The scan runs entirely on the device. It surfaces every finding so a developer can review it and remediate it directly on their own machine.

Secret Scanning is part of Aikido Device Protection. If you haven't deployed the agent yet, see Deploying Device Protection.

How it works

Secret Scanning is designed so that your secrets never leave the device.

• Scanning is fully local. The agent reads and inspects files on the device itself. File contents are never uploaded to Aikido.
• Secret values stay on the device. The full value of a detected secret is never transmitted. In the desktop client it is shown masked (for example [AIK********...]) so you can recognize it without exposing it.
• Only the secret type is reported. Aikido receives the type of secret that was found (for example "authorization token"), never the value itself. This gives your organization visibility into what kinds of secrets are being exposed, without ever seeing the secrets.

Reviewing detected secrets

Open the Secrets tab in the desktop client to see everything the agent has found. The tab shows a count of the total number of secrets detected.

Each finding shows:

• Type - A description of what was detected, for example "Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource."
• Location - The file and line where the secret was found, for example /Users/samuel/.zsh_history:370. When the same type of secret appears in multiple places, they are grouped together (for example, "and 8 more"). Expand the row to see every occurrence.
• Value - The detected secret, always masked.

Cleaning up secrets

You can remediate secrets one at a time or in bulk.

• One by one - Click the erase icon on a finding to clean that individual secret.
• In bulk - Use the checkboxes to select multiple findings, or select all secrets of a specific type, then clean them in a single action.

Cleaning removes the secret from the file on the device.

Cleaning a secret only removes it from the local file. If the secret is still valid, rotate or revoke it at its source so it can no longer be used.