> For the complete documentation index, see [llms.txt](https://docs.snyk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-secrets.md).

# Snyk Secrets

How Snyk Secrets scans repositories for hard-coded secrets and helps prevent leaks

The Snyk Secrets scanning tool provides accurate scanning across all repositories and includes governance features to prevent secret leaks.

Snyk Secrets provides the following features:

* Scans with low false-positive and high-recall rates using high entropy checks, machine learning (ML) semantic and contextual analysis, and regular expression (regex) pattern matching.
* Scans all plain text files (excluding binaries and lock files).
* Scans for secrets using the IDE (Visual Studio Code, Visual Studio, Eclipse and JetBrains), CLI (for local pre-commit and CI/CD scanning), and SCM (using recurring tests and scanning on import).
* Creates ignore requests to generate Secrets Consistent Ignores and governs the requests using the Ignore Approval Workflow.
* Creates [reports](https://docs.snyk.io/scan-fix-and-prevent/prevent/analytics/reports-tab) and analytics for findings and includes them when you export issue reports using the API.

{% hint style="info" %}
**Fake or AI generated secrets**

The Snyk Secrets scanner has low false-positive rates and will not detect any fake or AI generated secrets. Snyk recommends that you scan repos with genuine credentials.
{% endhint %}

## Prerequisites

Before you use Snyk Secrets, ensure you meet the following prerequisites:

* You must enable the Secrets setting on the organization level.
* Enable [Code Consistent Ignores](https://docs.snyk.io/scan-fix-and-prevent/fix/prioritize-issues-for-fixing/ignore-issues/consistent-ignores-for-snyk-code) to use Secrets Consistent Ignores and the Ignore Approval Workflow.
* Update your [IDE](https://docs.snyk.io/developer-tools/integrations/snyk-ide-plugins-and-extensions/release-and-support-policy-for-snyk-ide-plugins) and [CLI](https://docs.snyk.io/developer-tools/snyk-cli/releases-and-channels-for-the-snyk-cli) to the latest versions to scan for secrets.
* Workspaces must be enabled to leverage Secret scanning. You can [read more](https://docs.snyk.io/developer-tools/integrations/scm-integrations/workspaces) on Workspaces and how to enable them.

{% hint style="info" %}
To use Snyk Secrets, consider these system parameters and behaviors:

* Ignore requests are managed outside of pull request checks. For detailed scanning behavior, see [Secrets Pull Request checks](https://docs.snyk.io/scan-fix-and-prevent/prevent/pull-request-checks/secrets-pull-request-checks).
* Recurring tests do not generate email notifications.
* Snyk Secrets does not support binary and lock files.
* Repositories support up to 800 findings per scan. If an error alerts you that a repository exceeds this threshold, you can exclude the directories and files that hold known, non-production secrets by committing a `.snyk` file to your repository. Snyk applies these exclusions to both CLI and SCM scans. For details, visit [Use the `.snyk` file with Snyk Secrets](https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/pages/9glmQ5scbAaqPr49sLVE#use-the-.snyk-file-with-snyk-secrets). In the CLI, you can also use the `--exclude` option or scan sub-directories individually.
  {% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-secrets.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.