awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-05 03:26:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add concept docs for secrets mgmt, secret scanning, ssh

Browse Source
This commit is contained in:
Tuan Dang
2025-08-08 18:12:19 +07:00
parent 56f5249925
commit d88a473b47
10 changed files with 546 additions and 444 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/documentation/platform/secret-scanning/concepts/secret-scanning.mdx
+20
View File
@@ -0,0 +1,20 @@
---
title: "Secrets Scanning"
description: "Learn what is secret scanning and why it matters for building secure systems."
---
## What is Secret Scanning?
_Secret scanning_ is the process of monitoring code and related systems for exposed secrets — such as API keys, database credentials, and authentication tokens — that may have been accidentally committed or leaked.
As teams grow and development accelerates, it becomes easy for secrets to slip into version control, CI/CD pipelines, or shared files. Left undetected, secrets can fall into the wrong hands and give attackers direct access to production systems, third-party services, or internal APIs.
A secret scanning solution helps teams proactively identify and respond to these risks before they result in compromise. Rather than relying on manual review, secret scanning automates detection through pattern matching, entropy analysis, and contextual rules that surface secrets across your infrastructure and repositories.
## Secret Scanning in Infisical
Infisical Secret Scanning continuously monitors your source code and connected systems for exposed credentials. It integrates with platforms like [GitHub](/documentation/platform/secret-scanning/github), [GitLab](/documentation/platform/secret-scanning/gitlab), and [Bitbucket](/documentation/platform/secret-scanning/bitbucket) to scan codebases in real-time, detecting leaks as they happen and notifying administrators when action is needed.
Findings are surfaced with detailed context — including file location, commit metadata, and rule match — and can be tracked through their lifecycle using status labels like `Resolved`, `False Positive`, or `Ignored`. Teams can configure rules, exclusions, and thresholds to reduce noise and tailor detection to their environment.
In addition to real-time monitoring, Infisical supports both full repository scans and lightweight diff scans, as well as local pre-commit scanning via the [Infisical CLI](/cli/commands/scan). This allows teams to prevent secret leaks before they ever reach production.