---
metadata:
  - name: generator
    content: Diplodoc Platform v5.54.2
alternate:
  - https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/secret-scan.md
  - https://sourcecraft.dev/portal/docs/ru/sourcecraft/operations/secret-scan.md
  - href: en/sourcecraft/operations/secret-scan.md
    type: text/markdown
    title: Markdown version
  - href: ../../llms.txt
    type: text/markdown
    title: llms.txt
---
> **Documentation Index:** Fetch the complete configuration index at https://sourcecraft.dev/portal/docs/en/llms.txt

# Secret scanning in a SourceCraft repository

<!-- source: en/_includes/sourcecraft/secret-scan-intro.md -->
_Secret Scanning_ is a tool that checks every commit in the repository history for sensitive data contained in the code, e.g., API keys, tokens, certificates, and other secrets.
<!-- endsource: en/_includes/sourcecraft/secret-scan-intro.md -->

{% note warning %}

Deleting a commit with a secret is not a fail-safe measure. If its hash is disclosed, the commit remains accessible from the SourceCraft interface.

[Revoke and reissue](https://yandex.cloud/en/docs/iam/operations/compromised-credentials) any publicly available secrets.

{% endnote %}

To view secrets detected in a repository:
1. Open the SourceCraft [home page](https://sourcecraft.dev).
1. On the ![image](../../_assets/console-icons/house.svg) **Home** tab, navigate to ![image](../../_assets/console-icons/archive.svg) **Repositories** and select a repository.
1. Under ![image](../../_assets/console-icons/shield-exclamation.svg) **Security** on the repository page, go to ![image](../../_assets/console-icons/square-dashed-circle.svg) **Secret scanning**.

    {% note info %}

    Similarly, you can view a general list of detected secrets for all organization repositories.

    {% endnote %}

    The list of secrets shows the last detection date.

    To download a SARIF (Static Analysis Results Interchange Format) file for audit or integration with external systems, click **Download SARIF**.

1. To view information about a specific incident, select it from the list.

    <!-- source: en/_includes/sourcecraft/secret-scan-info.md -->
    For each secret found, the following information will be provided:
    * Secret type.
    * Commit ID and last detection time.
    * Path to the file and the code snippet containing the secret.
    * Incident status: **Open** or **Resolved**.
    * False positive mark (if any).
    <!-- endsource: en/_includes/sourcecraft/secret-scan-info.md -->

    Under **Activity**, you can view the history of events for a specific secret detected in the repository: when the warning was opened, who and when marked it as resolved or reopened it.

1. To mark an incident as resolved, follow these steps:
    1. Next to the incident, click **Resolved**.
    1. Add a comment for the incident.
    1. Optionally, mark the incident as a false positive.
    1. Click **Resolve**.
1. To reopen an incident, click **Reopen** next to it.
 
#### Useful links {#see-also}

* [Security in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/security/security-overview.md)
* [Setting up a custom security analyzer in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/tutorials/custom-security-analyzers.md)
* [Static application security testing in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/sast.md)
* [Security dashboard in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/security-dashboard.md)
* [Analyzing vulnerabilities in SourceCraft repository dependencies](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/supply-chain.md)