Secret Scanner helps you detect possible exposed secrets in Apidog assets, such as API keys, access tokens, credentials, webhook URLs, and other sensitive values. You can use Secret Scanner to review detected secrets, locate where they appear, manage detection patterns, and track whether a finding has been handled.Secret Scanner is available on Enterprise plans. Access to reports, analytics, and pattern management depends on your organization, team, and project permissions.
What You Can Do With Secret Scanner#
With Secret Scanner, you can:View secret risk reports across teams in an organization.
Review detected secrets in a team.
Locate where a detected secret appears.
Check whether a detected secret appears in published documentation.
Mark findings as resolved or reopen them.
Manage built-in and team custom detection patterns.
View team-level analytics for detected secrets.
Secret Scanner helps you detect and review possible exposed secrets. It does not automatically revoke, rotate, remove, or replace secrets for you.
Permissions#
Secret Scanner follows your organization, team, and project permissions.| Role | Available actions |
|---|
| Org Owner / Admin | View organization-level Secret Scanner reports. |
| Team Owner / Admin | View team findings, manage custom patterns, resolve or reopen findings, and view analytics. |
| Team Member / Guest | View Secret Scanner information according to their project access permissions. |
Team Members and Guests can only view findings for projects they have access to. They cannot manage custom patterns or view team analytics.
Organization Secret Scanner Reports#
Organization-level reports help Org Owners and Org Admins identify which teams have unresolved secret risks.1
Go to your Organization Settings.
2
In the Security menu, click Secret Scanner.
Team Secret Scanner#
Team-level Secret Scanner is available from team management.Team Secret Scanner includes the following sections:| Section | Description |
|---|
Secrets Detected | Review detected secret findings and their status. |
Patterns | View built-in patterns and manage team custom patterns. |
Analytics | View team-level statistics for detected secrets. Available to Team Owners and Team Admins. |
Review Detected Secrets#
Open Secrets Detected to view detected secret findings in the current team.A finding represents a detected secret grouped by its detection pattern and secure fingerprint. A finding may appear in multiple places. Each place where it appears is called an occurrence.The findings list includes information such as:Secret Scanner supports the following finding statuses:| Status | Description |
|---|
Unresolved | The finding still needs review or handling. |
Resolved | The finding has been handled or confirmed as not requiring further action. |
You can filter findings by:Secret values are masked in Secret Scanner. Apidog does not display the full raw secret value in the findings list or detail page.
Resolve or reopen a finding#
After reviewing a finding, you can update its resolution status.Supported resolution reasons include:| Resolution reason | When to use it |
|---|
Revoked | The exposed secret was real, and you have revoked, rotated, or invalidated it outside Apidog. |
False positive | The detected value is not an actual secret. |
Won't fix | The detected value is a real secret, but your team has decided not to change it. |
You can also reopen a resolved finding if it still needs follow-up.2
Select one or more findings.
3
Choose a resolution action, such as Revoked, False positive, or Won't fix.
4
Add an optional note if needed.
Marking a finding as resolved only updates its status in Apidog. It does not revoke, rotate, or invalidate the actual secret. If the secret is real, handle it in the service where it was issued.
Manage detection patterns#
Open Patterns to view and manage detection rules.Secret Scanner supports two types of patterns:| Pattern type | Description |
|---|
Built-in | Detection patterns provided by Apidog. Built-in patterns are read-only. |
Custom | Team-level patterns created by Team Owners or Team Admins. |
Built-in patterns#
Built-in patterns are managed by Apidog. You can view and search them, but you cannot edit, delete, enable, or disable them.For security reasons, Apidog does not expose the internal regular expressions of built-in patterns.Custom patterns#
Team Owners and Team Admins can create custom patterns to detect organization-specific secret formats.A custom pattern includes:Custom pattern limits include:| Item | Limit |
|---|
| Custom rules per team | Up to 5 |
| Name | Up to 128 characters |
| Regex pattern | Up to 256 characters in the UI |
| Keywords | Up to 10 |
| Each keyword | Up to 64 characters |
Custom patterns can be enabled or disabled.| Status | Description |
|---|
Enabled | The pattern is active and can produce new findings. |
Disabled | The pattern is inactive and does not produce new findings. |
Only Team Owners and Team Admins can create, edit, delete, enable, or disable custom patterns.
View analytics#
Team Owners and Team Admins can open Analytics to review team-level Secret Scanner statistics.Use analytics to understand where secret risks are concentrated and prioritize follow-up.Scan behavior#
Secret Scanner runs asynchronously. Results are not real-time. Last detected shows when the finding was last detected by the scanner.This means, scans are triggered when:The Save button is clicked after making changes to any of the assets.
Secret Scanner can help detect possible exposed secrets, but it cannot guarantee that every possible secret will be found. Continue to follow your team’s security review and credential management practices.
Supported asset types#
Secret Scanner can detect secrets across supported team and project assets, including:The exact source location shown for each occurrence depends on the resource type and your access permissions.Security notes#
To protect sensitive information, Apidog handles detected secrets carefully:Full secret values are not displayed in the UI.
Findings show masked values and masked snippets.
Findings are grouped using secure fingerprints instead of exposing the original secret value.
Access to findings follows organization, team, and project permissions.
Custom pattern regex values are visible only to users with the required team management permissions.
Limitations#
Prevent users from entering secrets.
Block API documentation publishing.
Automatically revoke or rotate external secrets.
Automatically remove secrets from source resources.
Automatically replace secrets with variables or vault references.
Scan external GitHub or GitLab repositories.
Guarantee complete detection of all possible secret formats.
If a real secret is detected, remove it from the source location and revoke or rotate it in the external system where it was issued.
