Detection reference · Updated 2026-11-03
What Redaxa detects
Every type of sensitive data Redaxa recognises in a prompt or a public repository, with the exact output its engine produces, what it deliberately skips and the false positives it still has. 31 pages, generated from the engine itself when the site is built.
How to read these pages
- Severity is set by the engine for the kind of data. Critical: direct account or system compromise, as with keys, passwords and tokens. High: direct financial exposure or a strong identifier, such as a card or national number. Medium: a personal identifier with real but indirect harm, such as an email, phone number or address. Low: a weak identifier that depends on context, such as a name or an IP address.
- One engine everywhere. The Chrome extension's free checks run it in your browser; the web check and the Windows app run it on Redaxa's server without storing the text; repository checks run it on the files of a public repository.
- No check proves a text is safe. Detection can miss sensitive information or flag harmless text; each page lists the misses and false positives we know about.
- Nothing is verified with a provider. Redaxa never tests whether a key works.
Credentials and secrets
Keys, tokens, passwords and private keys: leaking one can hand over an account or a system.
| What | Reported as | Severity | Replaced with |
|---|---|---|---|
| GitHub tokens | API key or token | critical | [SECRET] |
| GitLab personal access tokens | API key or token | critical | [SECRET] |
| OpenAI API keys | API key or token | critical | [SECRET] |
| Anthropic API keys | API key or token | critical | [SECRET] |
| Stripe keys and webhook secrets | API key or token | critical | [SECRET] |
| Supabase keys | API key or token | critical | [SECRET] |
| Slack tokens and webhook URLs | API key or token | critical | [SECRET] |
| Google API keys | API key or token | critical | [SECRET] |
| AWS access keys | API key or token | critical | [SECRET] |
| npm access tokens | API key or token | critical | [SECRET] |
| PyPI API tokens | API key or token | critical | [SECRET] |
| Hugging Face access tokens | API key or token | critical | [SECRET] |
| SendGrid API keys | API key or token | critical | [SECRET] |
| JSON Web Tokens (JWT) | API key or token | critical | [SECRET] |
| Bearer tokens | API key or token | critical | [SECRET] |
| Passwords in URLs | Password in a URL | critical | [REDACTED] |
| Secrets in configuration values | Secret in a configuration value | critical | [REDACTED] |
| Passwords written in text | Password or credential | critical | [REDACTED] (the word before it stays) |
| Private keys (PEM) | Private key | critical | [PRIVATE KEY] |
Personal data
Identifiers of people: contact details, national numbers, names and addresses.
| What | Reported as | Severity | Replaced with |
|---|---|---|---|
| Email addresses | Email address | medium | [EMAIL] |
| Phone numbers | Phone number | medium | [PHONE] |
| Personal names | Personal name | low | [NAME] |
| Street addresses | Street address | medium | [ADDRESS] |
| IPv4 addresses | IPv4 address | low | [IP ADDRESS] |
| US Social Security numbers | Social Security Number | high | [SSN] |
| UK National Insurance numbers | UK National Insurance number | high | [NI NUMBER] |
| Italian fiscal codes (codice fiscale) | Italian fiscal code | high | [FISCAL CODE] |
Financial data
Payment cards, bank accounts and wallet addresses.
| What | Reported as | Severity | Replaced with |
|---|---|---|---|
| Payment card numbers | Card number | high | [CARD] |
| IBANs | IBAN | high | [IBAN] |
| Crypto wallet addresses | Crypto wallet address | high | [WALLET ADDRESS] |
Your own terms
Client and project names that only you know are confidential.
| What | Reported as | Severity | Replaced with |
|---|---|---|---|
| Protected terms (client and project names) | Custom protected term | high | [CUSTOM TERM] |
Try it
Add the free Chrome extensionTry a web checkCheck a public repositoryPro and Business start with a 3-day free trial: a card or another payment method is needed, nothing is charged for 3 days, and you can cancel before it ends from Manage subscription.