Free secret scanner: find API keys and passwords in your code

Hardcoded secrets (API keys, access tokens, private keys and passwords committed to code) are one of the most common ways attackers get in, and one of the easiest to prevent. DepWarden's free secret scanner reads your source and configuration files against 33 secret and credential rules and flags what it finds, with the fix. No account is needed: paste code, upload a zip or connect a repository.

What it detects

• ASP.NET machineKey hardcoded in config
• AWS access key ID
• Azure storage account key
• Django SECRET_KEY hardcoded
• GitHub personal access token
• Hardcoded symmetric encryption key
• JWT signed with weak or hardcoded secret
• PGP private key block
• Possible AWS secret access key
• Private key embedded in source
• Secret hardcoded in shell export
• Stripe live secret key
• API key or token in URL query string
• ARG with secret-like default value
• Copying secret file into image (.env / .ssh / credentials)
• Database connection string with embedded password
• DigitalOcean personal access token
• GitHub Actions secret echoed in run step
• Google Cloud API key
• Hardcoded credentials
• Heroku API key
• JWT signed with hardcoded secret
• Mailchimp API key
• npm publish token
• Private key or passphrase pattern in config
• Secret value written to GITHUB_OUTPUT / GITHUB_ENV
• Secret-looking value in ENV directive
• SendGrid API key
• Slack API token
• Twilio account SID / auth token
• Credentials embedded in URL
• Firebase project credentials in source
• Generic hardcoded API key or token

Each finding carries a severity and a CWE (for hardcoded credentials, CWE-798), and the snippet shown in the results has the secret value redacted.

Where it looks

• Source code in every language the SAST scanner supports.
• Configuration and secret-bearing files: .env, .pem, .key, .cer, .crt, .ini, .toml, .cfg, .conf, .properties, .json and .xml.
• Infrastructure and CI files: Dockerfiles (ARG and ENV values, secret files copied into an image), GitHub Actions workflows and shell scripts.

If a secret is found

1. Rotate it first. Assume it is compromised. Removing it from the code does not un-leak it. 2. Remove it from the code and load it from an environment variable or a secrets manager. 3. Clean the history if it was committed, and check the logs of the service it unlocks. 4. Prevent a repeat: scan in CI, and consider a pre-commit hook so a secret never reaches the repository.

How it compares

Gitleaks and TruffleHog are well-known open-source secret scanners and are worth running as pre-commit hooks or in CI. Some scanners can test whether a found credential is still live; DepWarden does not, so treat every finding as needing rotation. DepWarden's advantage is speed and reach: nothing to install, and secret rules sit alongside 350 SAST rules in the same scan. See free SAST tools compared.

Frequently asked questions

Is the free secret scanner really free?

Yes, in the browser with no account. Running it from CI through an API key needs a plan that includes SAST.

Does it find secrets in git history?

It scans the files you paste, upload or connect (the current state of a branch). It does not walk old commits, so use a history-aware scanner such as Gitleaks or TruffleHog for that.

Are the results private?

Results stay in a private, session-isolated workspace you can clear at any time, and the snippets in findings have secret values redacted.

Keep going

Scan for the bugs around the secrets too: free SAST scanner, or by language: Python, JavaScript and TypeScript, Java, Go (Golang).