Secrets Scan

The secrets scan detects credentials, tokens, private keys, and hardcoded passwords in your source code and Git history. Gerion uses Gitleaks as the detection engine.

Run

gerion secrets-scan [PATH]

# Scan the current directory
gerion secrets-scan .

# Save results as JSON
gerion secrets-scan . --format json --output-file secrets.json

# Send results to the Gerion API
gerion secrets-scan . --api-url $GERION_API_URL --api-key $GERION_API_KEY

Detected secret types

Gitleaks includes more than 150 predefined rules:

Category	Examples
Cloud providers	AWS Access Keys, Google Cloud credentials, Azure secrets
Repositories & CI/CD	GitHub tokens, GitLab tokens, CircleCI tokens
Communication	Slack tokens, Twilio, Mailgun, SendGrid
Payments	Stripe keys, PayPal, Square
Databases	Connection strings with embedded credentials
Cryptography	RSA/EC/SSH private keys, PEM certificates
Generic APIs	Bearer tokens, API keys matching common patterns

Secret redaction

For security, Gerion CLI never sends the full secret to the platform. The value is redacted showing only 30% of the content (start + end):

AWS_ACCESS_KEY_ID: AKIA****[REDACTED]****XAMPLE

Caution

Redaction only applies to data sent to the API. In local CLI logs the secret may appear more visible. Do not share execution logs in public channels.

Options

Option	Description
--format	Output format: json | markdown | sarif
--output-file	Save results to a file (disables API submission)
--api-url	Gerion API Gateway URL
--api-key	M2M API key
--timeout	Timeout in seconds (default: 180)
--log-level	debug | info | warning | error