> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Detect leaked secrets

> Identify credentials that have been stored in source code or developer systems.

Infisical Secrets Scanning detects credentials that have been placed in locations where they shouldn't be stored, such as source code repositories, configuration files, and helper scripts. Scanning can be performed against connected cloud-hosted repositories or against local files on a developer's machine.

<Card title="Secrets Scanning docs" icon="radar" href="/docs/documentation/platform/secret-scanning/overview">
  Data sources, scan modes, findings and lifecycle, custom rules, and CLI usage.
</Card>

## Use cases

<CardGroup cols={2}>
  <Card title="Monitor connected repositories" icon="code-branch" href="/docs/documentation/platform/secret-scanning/github">
    Continuously scan GitHub, GitLab, and Bitbucket repositories as new commits are added.
  </Card>

  <Card title="Scan locally with the CLI" icon="terminal" href="/docs/cli/commands/scan">
    Scan a working directory, Git history, or staged changes before they're pushed to a shared branch.
  </Card>

  <Card title="Manage findings across scans" icon="list-check" href="/docs/documentation/platform/secret-scanning/overview">
    Review detected credentials with file, line, commit, and rule; resolve, ignore, or mark them as false positives.
  </Card>
</CardGroup>

## What is a leaked secret?

A leaked secret is a credential that has been stored or exposed in a location where it can be accessed by users who aren't authorized to use it. Common examples include public source code repositories, private repositories with a large set of readers, shared configuration files, and build logs. A credential that has been leaked can be used by anyone who can read it until the credential is rotated or revoked.

## Why scan for leaked secrets

Secrets are often leaked unintentionally. Common examples include committing a `.env` file to a repository, printing environment variables to a CI log, and pushing a script that contains credentials to a shared branch. These events don't require any intent to expose the credential, and they will continue to occur unless there is an automated process to detect them.

Secrets scanning provides this automated process. Continuous scanning of connected repositories detects credentials as new commits are added, and local scanning before a push prevents credentials from being pushed at all. Together, these two approaches reduce the time between when a credential is leaked and when it's detected.

## How Infisical does it

Infisical Secrets Scanning runs in two environments.

* **Connected repositories.** [GitHub](/docs/documentation/platform/secret-scanning/github), [GitLab](/docs/documentation/platform/secret-scanning/gitlab), and [Bitbucket](/docs/documentation/platform/secret-scanning/bitbucket) repositories can be monitored continuously. Each new commit is scanned. When a credential is detected, Infisical records a finding that includes the file path, line number, commit hash, and the detection rule that matched.
* **Local environments.** The [`infisical scan`](/docs/cli/commands/scan) CLI command scans a working directory, Git history, or staged changes in a CI pipeline before the changes are pushed to a shared branch.

The detection engine uses pattern matching, entropy analysis, and user-defined rules to identify credentials. Findings can be resolved, ignored, or marked as false positives, and each scan is recorded in an audit log. To reduce the number of false positives, users can define custom detection patterns, ignore rules through `infisical-scan:ignore` and `.infisicalignore`, adjust the entropy threshold, and exclude specific file paths from scanning.