> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/application-security/risk-management/monitor-and-manage-code-build/secrets-scanning.md).
# Secrets Scanning
Application Security scan capability detects secrets in files within your version control system (VCS) repositories and CI/CD executions. This functionality is accessible through the Prisma Cloud console, IDE, CLI, or git hook, allowing you to address and fix the issues that led to the exposure of secrets, such as removing the secrets from configuration files and storing them in secure storage mechanisms. The results of Secrets scanning are displayed on the integration outputs and **Projects** page.
* A secret is a programmatic access key that provides systems with access to information, services or assets. Developers use secrets such as API keys, encryption keys, OAuth tokens, certificates, PEM files, passwords, and passphrases to enable their application to securely communicate with other cloud services.
**Supported file types**: Prisma Cloud scans any plaintext files that are not encrypted, not compressed (for example, not `.zip` files) and not-compiled (for example, not `.jar` files), for secrets. Additionally, entropy findings look for keywords to lower the noise, and those keywords must be inline with the high entropy string to be flagged.
**Entropy Analysis**: Prisma Cloud has signatures that analyze the randomness of strings within the file. Highly random strings, often referred to as "high entropy," can be indicative of a potential secret. To reduce false positives, Prisma Cloud also considers specific keywords that might be associated with secrets alongside the randomness of the data for better accuracy.
**Limitation**: Secrets scanning in integrated version control systems supports repositories up to 4GB in size.
## Secrets Policies
* **Default Policies**: Prisma Cloud provides default policies designed to identify secrets that leverage both domain-specific and generic syntax. These policies match specific signatures and patterns to validate the likelihood or entropy of a string being a secret. For more information on Secrets policies refer to [Secrets Policies](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/policy-reference/secrets-policies/secrets-policies.md)
* **Custom Policies**: You can create custom Secrets policies tailored to your specific security posture and compliance requirements. For more information, refer to [Custom Build Policies](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/governance/custom-build-policies/custom-build-policies.md)
## Enable the Secrets Module
You must enable the Secrets module in order to scan for secrets: In **Application Security**, go to **Settings** > **Application Security** in the left menu under **Configuration** > enable **Secrets Security**.
For more information refer to [Application Security License Types](/content-collections/application-security/get-started/application-security-license-types.md).
## Advanced Secrets Scanner Configurations
In addition to the default settings for the Secrets scanner, you can configure the following advanced settings: **Validate Secrets** and **Scan Git History for Secrets**.
## Validate Secrets
Prisma Cloud can validate detected secrets against public APIs to verify their current activity status. This enables you to prioritize and promptly address exposed secrets. “Secrets” validation scanning can be executed through the Prisma Cloud console and IDE by extension, or through your CLI.
By default, the Secrets validation functionality is disabled.
### Enable Secrets Validation
1. On the console, in **Application Security**, select **Settings**.
2. Select **Application Security** in the left menu under **Configuration** > enable the **Validate Secrets** setting.
### Filter Secrets by Validation Status
You can prioritize secrets scan findings for remediation through the console by filtering secrets based on their validation status: In **Application Security**, select **Projects** > click the **Secrets** tab > select a value in the **Secrets Risk Factor** filter.
Secrets risk factor menu options include:
* **Valid**: Filter by whether the API key is valid. The API key is sent to a public API, such as the STS (Security Token Service) endpoint for AWS Access Keys. Prisma Cloud evaluates the response from the API to determine its validity
* **Invalid**: Filter by whether the API key is invalid. The API key is forwarded to a public API, and the response received is typically a "400," indicating an invalid API key
* **Unknown**: Filter by whether the API key is unable to make the API call or there is no API endpoint available for validation
* **Privileged**: This filter is exclusively for AWS access keys. Filter by whether API keys are deemed privileged, possessing certain permissions that are considered privileged based on predefined criteria
There is no validation for custom secrets.
### Validate Secrets though the CLI
1. Enable the **Validate Secrets** setting on the Prisma Cloud console - see **Validate Secrets though the Prisma Cloud console** above.
2. Add the environment variable `CKV_VALIDATE_SECRETS=true`.
Usage: `CKV_VALIDATE_SECRETS=true checkov -f secrets.txt`.
In the following example, a valid secret has been identified in the repository after conducting a Checkov scan in the CLI terminal.
### Scan Git History for Secrets
Prisma Cloud can scan through the git history of a repository to identify secrets that may have been deleted from a file but still exist in the historical records, and notify you about such secrets even if they are no longer present in the most recent commit. This helps to mitigate the risk of potential abuse of those credentials as they may still be compromised if found in history. This scan can be executed through the Prisma Cloud console and IDE by extension, or through your CLI.
By default, git history scanning is disabled.
### Enable Git History Scanning on Prisma Cloud
1. In **Application Security**, select **Settings**.
2. Select **Application Security** in the left menu under **Configuration** > enable the **Scan Git History for Secrets** setting.
### Enable Git History Scanning through the CLI
Scan your git history locally using Checkov CLI by executing the command with the `--scan-secrets-history` flag. By default, timeouts are not set, but you can specify one using the `--secrets-history-timeout TIME` flag.
Scans are performed in chunks and partial scans of chunks will not be saved. Additionally, results will not be saved on the Prisma Cloud platform.
## Scan Options
Prisma Cloud provides the following options for scanning secrets in your files.
**Automatic scans**:
* **Integration**: Scans are automatically initiated as soon as you integrate your repositories through the Prisma Cloud console
* **CI/CD runs**: Event driven scans are performed during runs in your CI/CD pipeline
* **IDE interaction**: **Opening or \*saving files** in your integrated IDE triggers an automatic scan
* **Pull Requests**: Submitting a pull request in your version control system prompts an automatic scan
**Manual scans**:
* **IDE**: You can trigger scans manually in your IDE. For more information refer to [IDE](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/application-security/get-started/connect-code-and-build-providers/ides/ides.md)
* **CLI commands**: By default, Checkov does not scan files for secrets. To enable Secrets scanning, execute the command with the `--enable-secret-scan-all-files flag` or set the `CKV_SECRETS_SCAN_ENABLE_ALL` environment variable. For more information on CLI based scanning, refer to the [CLI documentation](https://www.checkov.io/1.Welcome/Quick%20Start.html)
## Manage Scan Results
You can view, analyze and manage scan results, as well as prioritize remediation efforts, and implement effective fixes, or suppress findings, directly on the Prisma Cloud console, through your Checkov CLI, or directly within your IDE.
Secrets scanning does not support automatic fixes.
## Console Scan Management
To access scan management in the console, in **Application Security**, select **Projects** and click the **Secrets** tab.
### Prioritize Secrets Scan Findings using Filters
You can prioritize secrets scan findings for remediation by using the following filters to specifically target the secret issues that require attention:
* **Severity**: Select a severity level from the **Severity** filter. Values include **Critical**, **High**, **Medium**, **Low** and **Informational**
* **Secrets Risk Factor**: See [Filter by Validation Status](#filter-validation-status) above
* **Found in History**: Identifies whether secrets may have been stored in past commits
* **Issue Status**: The status of the finding. Values include 'Error', 'Passed', 'Suppressed', 'Fix Pending'
* **Repositories**: Filter by repository
* **Branch**: Filter by repository branch
* **Git Users**: Filter by Git users
* **File Types**: Filter by file type
For information on fixing Secrets issues, refer to [Fix Code Security Issues](/content-collections/application-security/risk-management/monitor-and-manage-code-build/fix-code-issues.md).
For information on suppressing Secrets issues, refer to [Suppress Code Issues](/content-collections/application-security/risk-management/monitor-and-manage-code-build/suppress-code-issues.md).
For more information on Secrets scan management on **Prisma Cloud console**, refer to [Monitor and Manage Code Build Issues](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/application-security/risk-management/monitor-and-manage-code-build/monitor-and-manage-code-build.md).
## Scan Management through IDEs
For information on scan management through IDEs, refer to the [IDE](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/application-security/get-started/connect-code-and-build-providers/ides/ides.md) documentation.
## Scan Management through the CLI
For information on scan management through the CLI, refer to the [CLI](https://www.checkov.io/1.Welcome/What%20is%20Checkov.html) documentation.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.prismacloud.io/content-collections/application-security/risk-management/monitor-and-manage-code-build/secrets-scanning.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.