Secrets

Last updated: Oct 26, 2026

---

Supported

Fluid Attacks detects more than 290 types of hardcoded secrets. For approximately half of them, it also checks with the provider if the secret continues to be active.

Fluid Attacks can detect these secrets. The list shows them by category, with examples of the providers:

• Cloud providers: AWS (access keys, session tokens, Cognito client secrets), Azure (SAS tokens, connection strings, DevOps personal access tokens), Google Cloud (API keys, service account keys), Alibaba Cloud, Cloudflare, DigitalOcean, Fly.io, Heroku, IBM Cloud, Linode, Netlify, Railway, Scaleway, Tencent Cloud, Vercel and Vultr
• Source code management, CI/CD and package registries: GitHub (all token types), GitLab, Bitbucket, Buildkite, CircleCI, Docker Hub, Drone CI, Jenkins, JFrog, npm, NuGet, Pulumi, PyPI, RubyGems, crates.io, TeamCity, Terraform Cloud and Travis CI
• AI and machine learning services: OpenAI, Anthropic, Cohere, DeepSeek, ElevenLabs, Groq, Hugging Face, Mistral, NVIDIA, OpenRouter, Perplexity, Pinecone, Replicate and xAI
• Payment processors and financial services: Stripe, PayPal, Braintree, Coinbase, Dwolla, Flutterwave, GoCardless, Mercado Pago, Pagar.me, Paystack, Plaid, Razorpay, Square, Wise and Xendit
• Communication and messaging: Slack (tokens and webhook URLs), Discord and Microsoft Teams webhook URLs, Mailchimp, Mailgun, Postmark, Resend, SendGrid, Brevo, Telegram, Twilio, Vonage, Webex and Zoom
• Monitoring and observability: Datadog, Dynatrace, Grafana, Honeycomb, New Relic, Opsgenie, PagerDuty, Rollbar, Sentry, Splunk and Sumo Logic
• Identity, secrets management and security tools: 1Password, Clerk, Doppler, Duo, HashiCorp Vault, JumpCloud, Keycloak, Okta, OneLogin, Ping Identity, Snyk, Stytch and Wiz
• Databases and data platforms: connection strings and credentials for PostgreSQL, MySQL, MariaDB, MongoDB, Redis, Oracle, IBM Db2, Couchbase, Neo4j, Snowflake, Amazon Redshift and RabbitMQ, and keys for Confluent, Databricks, Elastic, InfluxDB, PlanetScale and Supabase
• SaaS and productivity platforms: Airtable, Algolia, Atlassian (Jira, Confluence), Contentful, Figma, HubSpot, Intercom, Linear, Mapbox, Notion, Salesforce, Shopify, Typeform and Zendesk
• Credentials for protocols and services: FTP, LDAP, SMTP and SSH
• Keys and tokens: private keys (PEM, OpenSSH and PuTTY), JWT, and framework secrets (Django, Laravel and Ruby on Rails)
• Hardcoded credentials in configuration files
• Secrets in source code:
  • Express-session secrets
  • Hardcoded emails (in security-related contexts)
  • Hardcoded environment variables (for example, api_key, password, secret)
  • Hardcoded secrets in cryptographic calls
  • Initialization vectors
  • Salts
  • Symmetric keys
• Other obtained manually (only in the Advanced plan)

Unsupported

At this time, Fluid Attacks does not detect these secrets:

• Firebase Cloud Messaging server keys (Fluid Attacks detects Firebase web API keys as Google Cloud API keys)
• Generic secrets (random values with no provider-specific format or context)
• HTTP basic authentication parameters (for example, https://user:password@host URLs and Authorization: Basic headers) outside the supported databases and services
• Kubernetes secrets (Secret manifests and kubeconfig credentials)
• MFA tokens (for example, TOTP seeds and one-time password setup URIs)
• OAuth access and refresh tokens without a provider-specific format
• PGP private keys