{
  "slug": "modules/plaintext-secrets",
  "title": "Plaintext Secrets module",
  "description": "Polyglot source code scanner that detects hardcoded secrets, API keys, and credentials across all your projects.",
  "url": "https://cuitty.com/docs/modules/plaintext-secrets",
  "markdown_url": "https://cuitty.com/docs/modules/plaintext-secrets.md",
  "json_url": "https://cuitty.com/docs/modules/plaintext-secrets.json",
  "frontmatter": {
    "title": "Plaintext Secrets module",
    "description": "Polyglot source code scanner that detects hardcoded secrets, API keys, and credentials across all your projects.",
    "order": 14,
    "section": "Modules",
    "updatedAt": "2026-05-12"
  },
  "headings": [
    {
      "depth": 1,
      "slug": "plaintext-secrets-module",
      "text": "Plaintext Secrets module"
    },
    {
      "depth": 2,
      "slug": "how-it-works",
      "text": "How it works"
    },
    {
      "depth": 2,
      "slug": "supported-languages-and-bundlers",
      "text": "Supported languages and bundlers"
    },
    {
      "depth": 2,
      "slug": "pattern-categories",
      "text": "Pattern categories"
    },
    {
      "depth": 2,
      "slug": "extraction-modes",
      "text": "Extraction modes"
    },
    {
      "depth": 2,
      "slug": "cross-reference-engine",
      "text": "Cross-reference engine"
    },
    {
      "depth": 2,
      "slug": "entropy-detection",
      "text": "Entropy detection"
    },
    {
      "depth": 2,
      "slug": "api-endpoints",
      "text": "API endpoints"
    },
    {
      "depth": 2,
      "slug": "integration-events",
      "text": "Integration events"
    }
  ],
  "body_markdown": "# Plaintext Secrets module\n\nThe plaintext secrets module scans source code across all projects in your workspace to detect hardcoded secrets — API keys, database credentials, tokens, and private keys that should never be committed.\n\n## How it works\n\nPoint the scanner at one or more root directories (e.g. `~/Code`). It walks every file that isn't generated (skipping `node_modules`, `target/`, `.venv`, `dist/`, etc.), matches against 53 secret detection patterns, and optionally runs Shannon entropy analysis to catch novel credential formats.\n\nResults are persisted in a dedicated SQLite database. Each finding tracks the file, line, column, pattern that matched, severity, and temporal metadata — when the secret was first detected, when it was last seen, and whether it's still present.\n\n## Supported languages and bundlers\n\n| Ecosystem  | Scanned files                                   |\n| ---------- | ----------------------------------------------- |\n| JavaScript | `.ts`, `.js`, `.tsx`, `.jsx`, `.env*`, `.npmrc`  |\n| Rust       | `.rs`, `.toml`, `Cargo.toml`                    |\n| Python     | `.py`, `.cfg`, `.ini`, `.env*`                   |\n| Go         | `.go`, `.yaml`, `.yml`, `.env*`                  |\n| Config     | `.json`, `.yaml`, `.yml`, `.toml`, `.properties` |\n\nBundler-specific patterns detect tokens in `.npmrc`, `bunfig.toml`, `Cargo` registry config, PyPI tokens, and Docker registry credentials.\n\n## Pattern categories\n\n- **Cloud** — AWS access/secret keys, GCP service accounts and API keys, Azure connection strings, Cloudflare, Fly.io, DigitalOcean\n- **SCM** — GitHub PATs (classic and fine-grained), GitLab PATs, Bitbucket app passwords\n- **Payments** — Stripe secret/publishable/webhook keys, PayPal client secrets\n- **Database** — Connection strings with credentials (Postgres, MongoDB, Redis, MySQL), Turso, Supabase, Firebase\n- **Messaging** — Slack bot/user/app tokens, Discord tokens, Twilio, SendGrid\n- **Crypto** — PEM private keys (RSA, EC, PKCS8), JWTs, PGP/SSH private keys\n- **Generic** — Password assignments, API key assignments, bearer tokens, basic auth headers\n- **Bundler** — npm auth tokens, Cargo registry tokens, PyPI API tokens, Docker registry passwords\n\n## Extraction modes\n\nThe standalone JSON index can be configured with three extraction modes:\n\n| Mode             | Stores                    | Use case                           |\n| ---------------- | ------------------------- | ---------------------------------- |\n| `key-only`       | Key name only             | Auditing without exposure risk     |\n| `key-obfuscated` | Key name + masked value   | Triage with partial visibility     |\n| `key-raw`        | Key name + full value     | Remediation workflows              |\n\n## Cross-reference engine\n\nWhen the same secret value appears in multiple files or projects, the scanner groups them by SHA-256 hash. The dashboard highlights shared secrets so you can see which projects share credentials and prioritize rotation.\n\n## Entropy detection\n\nBeyond pattern matching, the scanner uses Shannon entropy analysis to flag high-entropy strings that may be novel credential formats. Configurable threshold (default: 4.5 bits), minimum length (20 chars), and automatic exclusion of UUIDs, URLs, commit hashes, and long base64 payloads.\n\n## API endpoints\n\n| Endpoint                                                   | Method | Returns                              |\n| ---------------------------------------------------------- | ------ | ------------------------------------ |\n| `/api/modules/plaintext-secrets/findings`                  | GET    | Paginated findings with filters      |\n| `/api/modules/plaintext-secrets/findings/{id}`             | GET    | Single finding with cross-references |\n| `/api/modules/plaintext-secrets/findings/{id}`             | POST   | Suppress a finding                   |\n| `/api/modules/plaintext-secrets/scans`                     | GET    | Scan history                         |\n| `/api/modules/plaintext-secrets/scan`                      | POST   | Trigger a new scan                   |\n\n## Integration events\n\nThe module emits events via the shared `ModuleEventBus`:\n\n- `secret:detected` — fired for each new finding during a scan\n- `cuitty.plaintext-secrets.scan-completed` — fired when a scan finishes, with summary stats",
  "body_html": "<h1 id=\"plaintext-secrets-module\">Plaintext Secrets module</h1>\n<p>The plaintext secrets module scans source code across all projects in your workspace to detect hardcoded secrets — API keys, database credentials, tokens, and private keys that should never be committed.</p>\n<h2 id=\"how-it-works\">How it works</h2>\n<p>Point the scanner at one or more root directories (e.g. <code>~/Code</code>). It walks every file that isn’t generated (skipping <code>node_modules</code>, <code>target/</code>, <code>.venv</code>, <code>dist/</code>, etc.), matches against 53 secret detection patterns, and optionally runs Shannon entropy analysis to catch novel credential formats.</p>\n<p>Results are persisted in a dedicated SQLite database. Each finding tracks the file, line, column, pattern that matched, severity, and temporal metadata — when the secret was first detected, when it was last seen, and whether it’s still present.</p>\n<h2 id=\"supported-languages-and-bundlers\">Supported languages and bundlers</h2>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n<table><thead><tr><th>Ecosystem</th><th>Scanned files</th></tr></thead><tbody><tr><td>JavaScript</td><td><code>.ts</code>, <code>.js</code>, <code>.tsx</code>, <code>.jsx</code>, <code>.env*</code>, <code>.npmrc</code></td></tr><tr><td>Rust</td><td><code>.rs</code>, <code>.toml</code>, <code>Cargo.toml</code></td></tr><tr><td>Python</td><td><code>.py</code>, <code>.cfg</code>, <code>.ini</code>, <code>.env*</code></td></tr><tr><td>Go</td><td><code>.go</code>, <code>.yaml</code>, <code>.yml</code>, <code>.env*</code></td></tr><tr><td>Config</td><td><code>.json</code>, <code>.yaml</code>, <code>.yml</code>, <code>.toml</code>, <code>.properties</code></td></tr></tbody></table>\n<p>Bundler-specific patterns detect tokens in <code>.npmrc</code>, <code>bunfig.toml</code>, <code>Cargo</code> registry config, PyPI tokens, and Docker registry credentials.</p>\n<h2 id=\"pattern-categories\">Pattern categories</h2>\n<ul>\n<li><strong>Cloud</strong> — AWS access/secret keys, GCP service accounts and API keys, Azure connection strings, Cloudflare, Fly.io, DigitalOcean</li>\n<li><strong>SCM</strong> — GitHub PATs (classic and fine-grained), GitLab PATs, Bitbucket app passwords</li>\n<li><strong>Payments</strong> — Stripe secret/publishable/webhook keys, PayPal client secrets</li>\n<li><strong>Database</strong> — Connection strings with credentials (Postgres, MongoDB, Redis, MySQL), Turso, Supabase, Firebase</li>\n<li><strong>Messaging</strong> — Slack bot/user/app tokens, Discord tokens, Twilio, SendGrid</li>\n<li><strong>Crypto</strong> — PEM private keys (RSA, EC, PKCS8), JWTs, PGP/SSH private keys</li>\n<li><strong>Generic</strong> — Password assignments, API key assignments, bearer tokens, basic auth headers</li>\n<li><strong>Bundler</strong> — npm auth tokens, Cargo registry tokens, PyPI API tokens, Docker registry passwords</li>\n</ul>\n<h2 id=\"extraction-modes\">Extraction modes</h2>\n<p>The standalone JSON index can be configured with three extraction modes:</p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n<table><thead><tr><th>Mode</th><th>Stores</th><th>Use case</th></tr></thead><tbody><tr><td><code>key-only</code></td><td>Key name only</td><td>Auditing without exposure risk</td></tr><tr><td><code>key-obfuscated</code></td><td>Key name + masked value</td><td>Triage with partial visibility</td></tr><tr><td><code>key-raw</code></td><td>Key name + full value</td><td>Remediation workflows</td></tr></tbody></table>\n<h2 id=\"cross-reference-engine\">Cross-reference engine</h2>\n<p>When the same secret value appears in multiple files or projects, the scanner groups them by SHA-256 hash. The dashboard highlights shared secrets so you can see which projects share credentials and prioritize rotation.</p>\n<h2 id=\"entropy-detection\">Entropy detection</h2>\n<p>Beyond pattern matching, the scanner uses Shannon entropy analysis to flag high-entropy strings that may be novel credential formats. Configurable threshold (default: 4.5 bits), minimum length (20 chars), and automatic exclusion of UUIDs, URLs, commit hashes, and long base64 payloads.</p>\n<h2 id=\"api-endpoints\">API endpoints</h2>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n<table><thead><tr><th>Endpoint</th><th>Method</th><th>Returns</th></tr></thead><tbody><tr><td><code>/api/modules/plaintext-secrets/findings</code></td><td>GET</td><td>Paginated findings with filters</td></tr><tr><td><code>/api/modules/plaintext-secrets/findings/{id}</code></td><td>GET</td><td>Single finding with cross-references</td></tr><tr><td><code>/api/modules/plaintext-secrets/findings/{id}</code></td><td>POST</td><td>Suppress a finding</td></tr><tr><td><code>/api/modules/plaintext-secrets/scans</code></td><td>GET</td><td>Scan history</td></tr><tr><td><code>/api/modules/plaintext-secrets/scan</code></td><td>POST</td><td>Trigger a new scan</td></tr></tbody></table>\n<h2 id=\"integration-events\">Integration events</h2>\n<p>The module emits events via the shared <code>ModuleEventBus</code>:</p>\n<ul>\n<li><code>secret:detected</code> — fired for each new finding during a scan</li>\n<li><code>cuitty.plaintext-secrets.scan-completed</code> — fired when a scan finishes, with summary stats</li>\n</ul>",
  "links_out": []
}