Credentials in context

Catches credentials that do not match a known vendor format — internal tokens, database passwords, connection strings. Default: report.

How it works

Rather than matching a shape, it looks for a credential-ish keyword close to a value that behaves like a secret. "password", "api_key", "token", "secret" next to something that looks like a value rather than a description.

Why it defaults to report, not warn

This is a heuristic and it is wrong more often than the format matchers. It deliberately filters out the common innocent cases — a type annotation like password: string, a placeholder with no digits, a variable name with no value attached — but it will still sometimes flag a config example.

Run it in report for a while and look at what it actually catches in Activity before you promote it. If your team writes a lot of infrastructure code, expect noise.

What is recorded

Kind and count only, like every other detector. Never the matched value.