> For the complete documentation index, see [llms.txt](https://docs.snyk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.snyk.io/developer-tools/snyk-cli/commands/secrets-test.md). # Secrets test ## Prerequisites To use the `snyk secrets test` command: * Install the latest version of the [Snyk CLI](/developer-tools/snyk-cli/install-the-snyk-cli.md) * [Authenticate](/developer-tools/snyk-cli/commands/auth.md) your machine with the Snyk CLI using `snyk auth`. * Ensure the Secrets feature is enabled for your Organization. If you receive a `SNYK-CLI-0016` error, contact your Snyk account manager. ## Usage `snyk secrets test [PATH]` ## Description Finds hard-coded secrets — API keys, passwords, and tokens — in your source code. Snyk scans the current directory or a specified path recursively. ## Exit codes **0**: Success. No secrets found, or all found secrets are ignored.\ **1**: Action needed. Secrets found require attention.\ **2**: Failure. An error occurred. ## Debug Use the `-d` option to output the debug logs. ## Options ### `--exclude=[,]...` Exclude directory names and file names from the scan. Provide a comma-separated list of names. Do not include a path. Example: `snyk secrets test --exclude=dir1,file2`. This excludes any directories and files named `dir1` and `file2` from the scan, such as `./dir1`, `./src/dir1`, `./file2`, and `./src/file2`. To persist the exclusions for everyone who scans the repository, and to apply them to SCM scans as well, use the `exclude` key of the `.snyk` file instead. Visit [Exclude files and directories from a scan](/developer-tools/snyk-cli/scan-and-maintain-projects-using-the-cli/snyk-cli-for-secrets/secrets-scanning-in-the-snyk-cli.md#exclude-files-and-directories-from-a-scan). ### `--org=` Specify the Snyk Organization to associate the test results with. Example: `snyk secrets test --org=` ### `--include-ignores` Include ignored findings in the scan results. Use this option to audit your codebase and review suppressed items. Example: `snyk secrets test --include-ignores` ### `--severity-threshold=` Report only vulnerabilities at the specified level or higher. Allowed values: `low`, `medium`, `high`, `critical`. ### `--report` Share results with the Snyk Web UI. This creates a Project in your Snyk account with a snapshot of the current issues, or appends the snapshot to an existing Project. After you use this option, log in to the Snyk website and view your Projects to see the snapshot. When you use `--report`, enable the **View Project Ignores** permission for the service account or user token. Snyk requires this permission to access ignore information when you report results. If Snyk returns a `403 Forbidden` error, ensure your service account role includes this permission. Example: `snyk secrets test --report` ### `--target-name=` Use this option in combination with the `--report` option. Set or override the target name for the Project. ### `--target-reference=` Use this option in combination with the `--report` option. Specify a reference that differentiates this Project, for example, a branch name or version. You can group Projects with the same reference. Example of setting to the current Git branch: `snyk secrets test --report --target-reference="$(git branch --show-current)"` Example of setting to the latest Git tag: `snyk secrets test --report --target-reference="$(git describe --tags --abbrev=0)"` ### `--project-environment=[,]...` Set the project environment attribute to one or more comma-separated values. To clear the project environment, set `--project-environment=`. Allowed values: `frontend`, `backend`, `internal`, `external`, `mobile`, `saas`, `onprem`, `hosted`, `distributed`. For more information, visit [Project attributes](/scan-fix-and-prevent/scan-with-snyk/snyk-projects/project-attributes.md). ### `--project-lifecycle=[,]...` Set the project lifecycle attribute to one or more comma-separated values. To clear the project lifecycle, set `--project-lifecycle=`. Allowed values: `production`, `development`, `sandbox`. For more information, visit [Project attributes](/scan-fix-and-prevent/scan-with-snyk/snyk-projects/project-attributes.md). ### `--project-business-criticality=[,]...` Set the project business-criticality attribute to one or more comma-separated values. To clear the project business criticality, set `--project-business-criticality=`. Allowed values: `critical`, `high`, `medium`, `low`. For more information, visit [Project attributes](/scan-fix-and-prevent/scan-with-snyk/snyk-projects/project-attributes.md). ### `--project-tags=[,]...` Set the project tags to one or more comma-separated key-value pairs with an `=` separator. Example: `snyk secrets test --project-tags=department=finance,team=alpha`. To clear the project tags, set `--project-tags=`. For more information, including allowable characters, visit [Project tags](/scan-fix-and-prevent/scan-with-snyk/snyk-projects/project-tags.md). ### `--json` Print results to the console as a JSON data structure. Example: `snyk secrets test --json` ### `--json-file-output=` Save test output as a JSON data structure directly to the specified file, regardless of whether you use the `--json` option. Use this option to display human-readable output in `stdout` while saving the JSON output to a file. For Secrets, Snyk does not create a JSON file if no issues are found. For open source, Snyk creates a file whether or not issues are found. Example: `snyk secrets test --json-file-output=detected-secrets.json` ### `--sarif` Return results in SARIF format. Example: `snyk secrets test --sarif` ### `--sarif-file-output=` Save test output in SARIF format directly to the `` file, regardless of whether you use the `--sarif` option. Use this option to display human-readable output in `stdout` while saving the SARIF output to a file. If you run multiple scans, such as Secrets and Code scans, the SARIF output includes data only from the most recently completed scan. If you run multiple scans sequentially and specify the same `--sarif-file-output` file path, each subsequent scan overwrites the previous SARIF file. To keep results separate, save each scan to a different SARIF output file. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.snyk.io/developer-tools/snyk-cli/commands/secrets-test.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.