> ## Documentation Index > Fetch the complete documentation index at: https://docs.infrawatch.com/llms.txt > Use this file to discover all available pages before exploring further. # Secrets > Find credential material exposed on your external surface, without ever handling the secret Secrets finds credential material exposed on your surface and gives you enough to confirm and revoke it, without Infrawatch ever handing the value back. A secret finding returns a SHA-256 fingerprint, never the secret itself. The fingerprint is enough to confirm a match against your own copy and to track the same exposure over time. That constraint is deliberate. Documentation, exports, and API responses about a leaked credential are themselves a place credentials leak, so the value never enters them. ## What a finding tells you | Field | What it gives you | | -------------------- | ------------------------------------------------ | | Secret kind | The type of credential that was matched | | Fingerprint | A SHA-256 digest to confirm which key this is | | Severity | Critical, high, moderate, low, or informational | | Confidence | How certain the detector is about the match | | Subject and target | What the credential belongs to and what it opens | | Host, port, protocol | The service it was found on | | Provider and service | The platform the credential is for | | Location | Where on the surface it was found | Each finding also carries structured evidence with a versioned schema, so an integration can parse it rather than scrape a description, and the discovery channel that surfaced it. ## Triage Filter by severity to get to the credentials that open something important. Confidence is the second axis: a critical severity at low confidence is worth confirming with the fingerprint before you page anyone. Because the fingerprint is stable, you can match a finding against your own secret store to identify the exact key, then rotate it without ever needing Infrawatch to reveal the value. ## Work the finding Secrets use the shared finding lifecycle: accept, resolve, ignore, mark false positive, or reopen. Resolve once the credential is rotated, not when the file is removed, because the exposed value stays valid until it is revoked. Reading secret findings requires the `esi.findings.view` scope, and applying lifecycle actions requires `esi.findings.manage`. Inventory, findings, and the rest of the workspace. Exposed files and directory listings across the wider internet.