Secret scanning

Stops credentials from leaving your organization inside a prompt. Default: warn. This
is the detector most organizations move to block first, and the one where doing so is
least controversial.
What it looks for
Recognizable, high-confidence credential formats:
AWS access key IDs
GitHub tokens and personal access tokens
PEM private keys
Anthropic API keys (
sk-ant-…)
OpenAI API keys (
sk-…, 
sk-proj-…)
Slack tokens
Google API keys
JSON Web Tokens
These are matched on shape, so the false-positive rate is low — but an example key in
documentation your developer pasted will trip it, which is the right outcome anyway.
What is recorded
The kind and the count. Never the value. A finding says "one AWS access key id was
present"; it does not store the key, an offset, or a preview. Building a security product
that quietly collects a database of everybody's leaked credentials would be indefensible,
so the detector is built so that it cannot.
The sensitivity dial does not apply
Detected secrets are handled according to this detector's action regardless of where
the risk classifier sensitivity is set. The dial governs the semantic classifier, not
pattern matching.
Setting it
Policy → Risk detectors → Secret scanning.