Snyk Secrets
The Snyk Secrets scanning tool provides accurate scanning across all repositories and includes governance features to prevent secret leaks.
Snyk Secrets provides the following features:
Scans with low false-positive and high-recall rates using high entropy checks, machine learning (ML) semantic and contextual analysis, and regular expression (regex) pattern matching.
Scans all plain text files (excluding binaries and lock files).
Scans for secrets using the IDE (Visual Studio Code, Visual Studio, Eclipse and JetBrains), CLI (for local pre-commit and CI/CD scanning), and SCM (using recurring tests and scanning on import).
Creates ignore requests to generate Secrets Consistent Ignores and governs the requests using the Ignore Approval Workflow.
Creates reports and analytics for findings and includes them when you export issue reports using the API.
Fake or AI generated secrets
The Snyk Secrets scanner has low false-positive rates and will not detect any fake or AI generated secrets. Snyk recommends that you scan repos with genuine credentials.
Prerequisites
Before you use Snyk Secrets, ensure you meet the following prerequisites:
You must enable the Secrets setting on the organization level.
Enable Code Consistent Ignores to use Secrets Consistent Ignores and the Ignore Approval Workflow.
Workspaces must be enabled to leverage Secret scanning. You can read more on Workspaces and how to enable them.
To use Snyk Secrets, consider these system parameters and behaviors:
Ignore requests are managed outside of pull request checks. For detailed scanning behavior, see Secrets Pull Request checks.
Recurring tests do not generate email notifications.
Snyk Secrets does not support binary and lock files.
Repositories support up to 800 findings per scan. If an error alerts you that a repository exceeds this threshold, you can manage this in the CLI by excluding specific directories or scanning sub-directories individually.
Last updated
Was this helpful?