·3 min read
ByGabriel CA·Kraftwire Software

How does an exposed API key detector find secrets?

Illustration for How does an exposed API key detector find secrets?

Gitleaks is a secret detector that searches files and Git repos. Source Exposure occurs when server secrets reach client code by mistake.

Exposure glossary They can also reach outsiders through version control or public files. Exposure glossary

Gitleaks rules match secret text and can check its Shannon entropy. Source For secrets it can classify, TruffleHog can log in to check validity. Source

What does an exposed API key detector look for?

Exposure involves server-side secrets accidentally placed in client code or public assets. Exposure glossary These leaks let unauthorized people access secrets meant for server-side use. Exposure glossary Gitleaks searches Git repos and files for keys, passwords, and tokens. github.com

Common leak paths include hardcoded frontend secrets and committed .env files. vibeappscanner.com Secrets can also leak through logs and client-side environment variables. vibeappscanner.com

How do patterns, entropy, and live checks find keys?

Gitleaks rules use regular expressions, or regex patterns, to match secret text. github.com A rule's secretGroup selects the matched portion for an entropy check. github.com Its entropy setting sets the minimum Shannon entropy for that group. github.com

Shannon entropy helps tell random-looking text apart from normal code. blog.miloslavhomer.cz But their scores overlap, so a scan can flag text that is not secret. blog.miloslavhomer.cz

TruffleHog identifies secret types, such as AWS secrets and Stripe secrets. TruffleHog For secrets it can classify, TruffleHog can log in to confirm validity. TruffleHog

Where do detectors inspect for leaked credentials?

Gitleaks can scan Git repos, files, and text fed through standard input (stdin). github.com Its Git scan walks past commits and checks each line against active rules. starlog.is

Secrets can leak through client-side environment variables with NEXT_PUBLIC_ or VITE_ prefixes. vibeappscanner.com Public source maps, such as main.js.map, can reveal keys stored in code. wstg.owasp.org These files can also reveal internal API paths and how sign-in checks work. wstg.owasp.org

Live URL checks and source reviews answer different questions. vibeappscanner.com A URL does not give access to private source code. vibeappscanner.com A source-code report does not test the deployed app. vibeappscanner.com

Back4app's Master Key must stay server-side and never enter a client bundle. www.back4app.com For more on this exposure path, read API keys in frontend code.

How can you distinguish secrets from public client keys?

Back4app's Application ID and client keys ship inside apps by design. www.back4app.com These keys do not control access; the server checks access rights. www.back4app.com

Back4app checks each request against class-level permissions (CLPs) and access control lists (ACLs). www.back4app.com These access rules give an extracted client key only an anonymous user's access. www.back4app.com Its Master Key skips both sets of rules and must stay server-side. www.back4app.com

Back4app names Cloud Code and trusted backends as server-side Master Key locations. Source

What can automated detection miss or misclassify?

Secret text and harmless text can have overlapping entropy scores. blog.miloslavhomer.cz Gitleaks can also flag test files because it matches patterns without live key checks. dev.to

Static scans can miss keys joined from text parts when code runs. starlog.is Changed text forms, such as hex encoding or ROT13, can evade these scans. starlog.is

Gitleaks rules include path filters and allowlists, not just patterns and entropy limits. starlog.is Its secretGroup picks the text checked for entropy when that check is set. github.com The rule's entropy value gives the lowest Shannon entropy that group must have. github.com

Sources

Every figure above was checked against the page it cites · here they are, so you can check them too.

  1. Secrets can also leak through logs and client-side environment variables. · Live URL checks and source reviews answer different questions. · A URL does not give access to private source code. · A source-code report does not test the deployed app. · Source Exposure occurs when server secrets reach client code by mistake. · Exposure glossary They can also reach outsiders through version control or public files. · Exposure involves server-side secrets accidentally placed in client code or public assets. · Exposure glossary These leaks let unauthorized people access secrets meant for server-side use. · Common leak paths include hardcoded frontend secrets and committed .env files. · Secrets can leak through client-side environment variables with NEXT_PUBLIC_ or VITE_ prefixes. · vibeappscanner.com
  2. Gitleaks rules use regular expressions, or regex patterns, to match secret text. · Gitleaks finds keys in files and Git repos. · Gitleaks is a secret detector that searches files and Git repos. · Gitleaks Its rules match secret text and can check that text's Shannon entropy. · Gitleaks rules match secret text and can check its Shannon entropy. · Exposure glossary Gitleaks searches Git repos and files for keys, passwords, and tokens. · A rule's secretGroup selects the matched portion for an entropy check. · Its entropy setting sets the minimum Shannon entropy for that group. · Gitleaks can scan Git repos, files, and text fed through standard input (stdin). · Gitleaks rules include path filters and allowlists, not just patterns and entropy limits. · Its secretGroup picks the text checked for entropy when that check is set. · The rule's entropy value gives the lowest Shannon entropy that group must have. · github.com
  3. Back4app's Master Key must stay server-side and never enter a client bundle. · Back4app's Application ID and client keys ship inside apps by design. · These keys do not control access; the server checks access rights. · Back4app checks each request against class-level permissions (CLPs) and access control lists (ACLs). · These access rules give an extracted client key only an anonymous user's access. · Its Master Key skips both sets of rules and must stay server-side. · Back4app names Cloud Code and trusted backends as server-side Master Key locations. · back4app.com
  4. Gitleaks For secrets it can classify, TruffleHog can log in to check validity. · Source For secrets it can classify, TruffleHog can log in to check validity. · TruffleHog identifies secret types, such as AWS secrets and Stripe secrets. · TruffleHog For secrets it can classify, TruffleHog can log in to confirm validity. · github.com
  5. Shannon entropy helps tell random-looking text apart from normal code. · But their scores overlap, so a scan can flag text that is not secret. · Secret text and harmless text can have overlapping entropy scores. · blog.miloslavhomer.cz
  6. Its Git scan walks past commits and checks each line against active rules. · Static scans can miss keys joined from text parts when code runs. · Changed text forms, such as hex encoding or ROT13, can evade these scans. · starlog.is
  7. Public source maps, such as main.js.map, can reveal keys stored in code. · These files can also reveal internal API paths and how sign-in checks work. · wstg.owasp.org
  8. Gitleaks can also flag test files because it matches patterns without live key checks. · dev.to

Is your app secure? Run a free security scan in 30 seconds · no signup required.

Scan your app free →