Secrets Detection

Relevant source files

The following files were used as context for generating this wiki page:

• risk/secrets_detection.py
• scripts/validate_fixops.py
• scripts/generate_analysis.py
• enterprise/src/services/advanced_pentest_engine.py
• e2e_orchestration/APP4/inputs/findings.json

Secrets Detection is a core security capability within the FixOps platform designed to identify, categorize, and provide remediation guidance for hardcoded sensitive information. This module uses proprietary scanning logic to detect various types of credentials, including API keys, passwords, access tokens, and cloud-specific credentials, across a wide range of code and configuration file formats.

The system functions by recursively scanning a codebase and applying regex-based patterns to identify high-risk strings. Each discovery is enriched with context, severity ratings, and specific recommendations to help developers migrate these secrets to secure management services like AWS Secrets Manager or other environment variable-based solutions.

Architecture and Core Logic

The detection engine is primarily encapsulated in the SecretsDetector class. It manages the lifecycle of a scan, from building pattern sets to aggregating results into a structured format.

Scanning Workflow

The scanner follows a structured process to ensure comprehensive coverage while respecting performance constraints:

1. Initialization: Loads configuration and builds regex patterns for supported SecretType enums.
2. File Discovery: Recursively traverses the directory tree, filtering for specific code and configuration extensions (e.g., .py, .env, .yaml, .json).
3. Exclusion Handling: Skips directories identified in the exclude_paths list, such as .git, node_modules, and virtual environments.
4. Pattern Matching: Performs multi-line, case-insensitive regex matching against file contents.
5. Context Extraction: Captures the line number and surrounding lines of code to provide context for the security finding.

The diagram above illustrates the logical flow of the SecretsDetector.scan method.
Sources: risk/secrets_detection.py:61-125, scripts/validate_fixops.py:101-118

Data Structures and Models

The system uses several dataclasses to standardize the representation of security risks and scan metadata.

SecretFinding

Represents a single instance of a hardcoded secret discovered during a scan.

• secret_type: The category of secret (e.g., AWS_CREDENTIAL, GITHUB_TOKEN).
• severity: A string indicating the risk level (critical, high, medium, low).
• context: Snippet of code surrounding the match (typically 3 lines before and after).
• matched_pattern: The first 50 characters of the actual string that triggered the match.

SecretsDetectionResult

An aggregate object containing the outcome of a full scan.

• findings: A list of SecretFinding objects.
• findings_by_type: A dictionary summarizing counts for each SecretType.
• files_scanned: Total count of files processed.

Supported Secret Types and Patterns

The engine recognizes several proprietary secret formats.

Secret Type	Example Regex Focus	Default Severity
PASSWORD	password, passwd, pwd followed by assignment	critical
PRIVATE_KEY	-----BEGIN RSA PRIVATE KEY-----	critical
AWS_CREDENTIAL	AWS_ACCESS_KEY_ID or AWS_SECRET_ACCESS_KEY	critical
GITHUB_TOKEN	ghp_ followed by 36 alphanumeric characters	high
API_KEY	api_key or apikey strings	high
GCP_CREDENTIAL	service_account type and private_key_id	high

Sources: risk/secrets_detection.py:17-59, e2e_orchestration/APP4/inputs/findings.json:10-15

Integration with Threat Intelligence

Secrets detection results are often consumed by higher-level engines, such as the Advanced Penetration Testing Engine, to model attack chains.

Attack Simulation

The platform can simulate how an exposed secret leads to deeper system compromise. For instance, hardcoded MQTT credentials or AWS keys can be used as a "step" in a ChainedExploit or to define a PrivilegeEscalationPath. The BusinessImpactQuantifier may use the presence of secrets to calculate revenue_at_risk_usd or regulatory_fine_risk_usd.

This sequence demonstrates how a low-level secret discovery propagates through the platform's analysis layers.
Sources: fixops-enterprise/src/services/advanced_pentest_engine.py:202-230, fixops-enterprise/src/services/advanced_pentest_engine.py:895-925

Implementation Quality and Validation

The FixOps repository includes utility scripts to ensure the integrity of the secrets detection module.

• validate_fixops.py: A CodeValidator class checks if risk/secrets_detection.py exists and is syntactically valid. It also analyzes the module's complexity, counting classes and functions to ensure algorithmic sophistication.
• generate_analysis.py: Automatically identifies risk/secrets_detection.py as part of the "Core Logic" role and flags it for risks such as "file-io" and "regex-usage" during automated report generation.

# Example of a proprietary secret pattern used in risk/secrets_detection.py
{
    "pattern": r'github[_-]?token\s*[=:]\s*["\'](https://github.com/DevOpsMadDog/Fixops/blob/HEAD/ghp_%5BA-Za-z0-9%5D%7B36%7D)["\']',
    "severity": "high",
}

Sources: scripts/validate_fixops.py:17-55, scripts/generate_analysis.py:72-85, risk/secrets_detection.py:100-105

Conclusion

The Secrets Detection system provides a critical first line of defense by identifying high-risk credentials before they can be exploited. By categorizing secrets with distinct severities and integrating these findings into the broader threat intelligence and business impact framework, FixOps enables organizations to prioritize remediation based on actual financial and operational risk.

Sources: risk/secrets_detection.py:1-200, fixops-enterprise/src/services/advanced_pentest_engine.py:1150-1175