Secrets forgotten in the code

"Detected secrets" page

When you build a small in-house tool, a script that sends out quotes, a page that queries the database, you sometimes write a password straight into it, "just for testing". Then you forget it. This page goes and finds them.

What it shows

Each line gives the type of secret found, the file, the line number, the detection date, and a masked value. The secret itself is never shown in full: seeing that it exists is enough to decide.

Four counters at the top: the total number of findings, those still open, those judged critical and needing rotation, and the number of code repositories watched.

Two possible answers

Mark as rotated: you have replaced the password concerned. The line closes. False positive: it was not a real secret, an example in some documentation, a dummy value. The line closes too, and the tool learns.

Does this concern me?

If your company develops nothing, the page stays empty and displays a message saying so. At Les Ateliers, a former intern had written a small export program; two lines came up, they were dealt with in half an hour, and the page has been empty ever since.

A severity filter and a free search help you sort things once the list grows. Everything exports to a spreadsheet, to discuss with whoever wrote the code.