Pipeline Secrets Leak Scanner

WHAT IT DOES

This tool scans smart contract source code and deployment pipelines for hardcoded secrets, API keys, private keys, and sensitive credentials. It analyzes verified source code from block explorers and GitHub repository data (when available) to detect secret patterns such as private keys, API tokens, database passwords, JWT secrets, AWS access keys, and webhook URLs. The scanner uses pattern matching and heuristic analysis to identify potential secrets in code, configuration files, and deployment scripts. Results are presented as a detailed secret leak report with severity levels (critical/high/medium/low), precise locations, and actionable remediation recommendations. This is essential for security teams preventing credential exposure, developers removing hardcoded secrets, and auditors ensuring pipeline security.

HOW TO USE

Connect your wallet (read-only, no transaction required) and select the target network. Enter the scan name, contract address, and optionally the GitHub repository (owner/repo) for deeper pipeline analysis. Click "scan for secrets" and the tool will verify the contract, fetch source code, and analyze both contract code and pipeline configurations for secret patterns. Results display a summary with severity counts, detailed secret cards showing each finding with location, detail, and remediation recommendation, and a table of all secrets with their locations. Use the report to identify and remediate secret exposures, rotate compromised credentials, and prevent future leaks.

TECHNICAL MECHANISM

The scanner uses ethers.js v5.7.2 and pattern matching algorithms to perform a multi-stage secret detection analysis. First, it calls eth_getCode to verify the contract is deployed and uses block explorer APIs (Etherscan, Sourcify) to fetch verified source code. The tool then scans the source code using a comprehensive set of secret detection patterns—including regular expressions for private keys (hex strings, base58, PEM formats), API keys for common services, JWT tokens, AWS credentials, and other sensitive patterns. It also analyzes GitHub repository data when provided, scanning configuration files, deployment scripts, and pipeline configurations for similar patterns. Each potential secret is classified by severity based on the sensitivity of the credential type and the context in which it appears. Critical secrets (private keys, AWS access keys) receive the highest severity, while lower-severity findings (test keys, non-production tokens) are flagged accordingly. Results are compiled into a structured report with detailed finding information, location references, and prioritized remediation recommendations.

WHAT IT CANNOT SEE

This tool cannot detect secrets that are encrypted, hashed, or obfuscated in ways that avoid pattern matching—it relies on plaintext detection. It is limited by the availability and completeness of source code verification and repository access; contracts that are not verified or private repositories that are inaccessible cannot be scanned. It cannot analyze private repositories or contracts with limited source code exposure where deployment configurations are not accessible. The analysis relies on the accuracy and completeness of pattern matching and secret detection algorithms; new or unknown secret formats may be missed. It cannot detect secrets that are stored off-chain, in external services, or in environment variables that are not captured in the source code or repository. The tool is limited to the specific contract instances and deployment configurations that are accessible via RPC and APIs. It cannot guarantee that all secrets are detected without manual review and additional security scanning tools—the scanner is a first line of defense, not a comprehensive security audit.

PLEASE NOTE

This is a read‑only analytics tool—it never submits transactions or modifies contract state. It is designed for EVM‑compatible chains and works best with verified contracts that have accessible source code and optional GitHub repository access. The secret scan report is for informational and security purposes only and should be considered a starting point for secret remediation. Always manually review detected secrets, rotate compromised credentials immediately, and follow security best practices for secret management. The tool's pattern detection is heuristic—false positives may occur and should be verified manually. For production environments, use dedicated secret scanning tools and secure credential storage solutions.