Skip to content

Request early access

Fill out the form and we will be in touch.

We'll only use this data to reply to your request. See our privacy policy.

Secrets Scan

The secrets scan detects credentials, tokens, private keys, and hardcoded passwords in the files of your repository (it does not scan the Git history). Gerion uses Gitleaks as the detection engine.

Run

Section titled “Run”
Ventana de terminal
gerion secrets-scan [PATH]
Ventana de terminal
# Scan the current directory
gerion secrets-scan .


# Save results as JSON
gerion secrets-scan . --format json --output-file secrets.json


# Send results to the Gerion API
gerion secrets-scan . --api-url $GERION_API_URL --api-key $GERION_API_KEY

Detected secret types

Section titled “Detected secret types”

Gitleaks includes more than 150 predefined rules:

Category Examples
Cloud providers AWS Access Keys, Google Cloud credentials, Azure secrets
Repositories & CI/CD GitHub tokens, GitLab tokens, CircleCI tokens
Communication Slack tokens, Twilio, Mailgun, SendGrid
Payments Stripe keys, PayPal, Square
Databases Connection strings with embedded credentials
Cryptography RSA/EC/SSH private keys, PEM certificates
Generic APIs Bearer tokens, API keys matching common patterns

Secret redaction

Section titled “Secret redaction”

For security, Gerion CLI never sends the full secret to the platform. The value is redacted showing only 30% of the content (start + end):

AWS_ACCESS_KEY_ID: AKIA****[REDACTED]****XAMPLE

Options

Section titled “Options”
Option Description
--format Output format: json | markdown | sarif
--output-file Save results to a file (disables API submission)
--api-url Gerion API Gateway URL
--api-key M2M API key
--timeout Timeout in seconds (default: 180)
--log-level debug | info | warning | error