Skip to main content
Secrets finds credential material exposed on your surface and gives you enough to confirm and revoke it, without Infrawatch ever handing the value back.
A secret finding returns a SHA-256 fingerprint, never the secret itself. The fingerprint is enough to confirm a match against your own copy and to track the same exposure over time.
That constraint is deliberate. Documentation, exports, and API responses about a leaked credential are themselves a place credentials leak, so the value never enters them.

​
What a finding tells you

Each finding also carries structured evidence with a versioned schema, so an integration can parse it rather than scrape a description, and the discovery channel that surfaced it.

​
Triage

Filter by severity to get to the credentials that open something important. Confidence is the second axis: a critical severity at low confidence is worth confirming with the fingerprint before you page anyone. Because the fingerprint is stable, you can match a finding against your own secret store to identify the exact key, then rotate it without ever needing Infrawatch to reveal the value.

​
Work the finding

Secrets use the shared finding lifecycle: accept, resolve, ignore, mark false positive, or reopen. Resolve once the credential is rotated, not when the file is removed, because the exposed value stays valid until it is revoked. Reading secret findings requires the esi.findings.view scope, and applying lifecycle actions requires esi.findings.manage.

External surface overview

Inventory, findings, and the rest of the workspace.

Open directories

Exposed files and directory listings across the wider internet.