Skip to main content
Infisical Secret Scanning helps you find credentials, such as API keys, database passwords, and tokens, that were committed to source code. You can scan code on your own machine (or in CI) using the Infisical CLI, or connect your GitHub, GitLab, and Bitbucket repositories so that Infisical scans them and records each secret it finds.
To learn how Infisical scans your secrets, check out the Concepts page.

​
Scanning locally

Scan your code with the Infisical CLI before you push it:

Scan with the CLI

Scan a Git repository’s history or a directory for leaked secrets with infisical scan.

Pre-commit hook

Prevent secrets from getting committed with a pre-commit hook that runs infisical scan.

Ignore findings

Stop infisical scan from reporting secrets you’ve decided are safe to commit.

Configuration

Add your own detection rules to infisical scan and skip secrets you’ve decided are safe.

​
Scanning repositories

Connect your repositories to Infisical, review the secrets it finds, and configure the rules it scans with:

GitHub

Scan the repositories a GitHub Radar connection can access.

GitLab

Scan one GitLab project, or the projects in a group.

Bitbucket

Scan the repositories in a Bitbucket workspace.

Findings

Review the secrets Infisical finds in your repositories.

Configuration

Add your own detection rules and skip secrets you’ve decided are safe.