Detection reference · Credentials and secrets · Updated 2026-11-03

Passwords written in plain text

People write passwords in tickets and chats as "the password is …". The hard part is not flagging every sentence that mentions a password reset, so the rule looks at what follows the word.

At a glance

Reported as	Password or credential
Category	Credentials and secrets
Severity	critical: direct account or system compromise, as with keys, passwords and tokens
Replaced with	`[REDACTED] (the word before it stays)`
Where it runs	The same engine runs in the Chrome extension (free checks, on your device), in the web check and the Windows app (on Redaxa's server; the text is not stored) and in public repository checks.
Engine rule	scanner.ts, line 249

What it looks like

password, passwd, pwd or secret, then a separator or "is"/"was", then a value of at least 4 characters. With : or = any literal counts; after a space or "is" the value must contain a digit or mixed case.

Example 1

You paste

The VPN password is Winter2026

Redaxa returns

The VPN password is [REDACTED]

Reported as	Password or credential
Severity	critical: direct account or system compromise, as with keys, passwords and tokens
Replaced with	`[REDACTED] (the word before it stays)`
Probable service	Unknown service
Credential type	Password or credential
Evidence	The value alone does not identify its owner or issuing service.
Recommended action	Identify owner, then rotate if genuine

Example 2

You paste

the admin password was Sample2026

Redaxa returns

the admin password was [REDACTED]

Reported as	Password or credential
Severity	critical: direct account or system compromise, as with keys, passwords and tokens
Replaced with	`[REDACTED] (the word before it stays)`
Probable service	Unknown service
Credential type	Password or credential
Evidence	The value alone does not identify its owner or issuing service.
Recommended action	Identify owner, then rotate if genuine

All values on this page are synthetic or published specimens; none is a working credential or a real person's data.

In a repository check

The same example, committed to a public repository and run through the free repository check:

docs/onboarding.md: Password or credential, listed as a reference, not counted as an exposure (severity info). Mention of a password/secret in prose or code, without a literal credential assignment.
Same value in tests/fixtures/onboarding.md: Mention of a password/secret in prose or code, without a literal credential assignment.

Values are always shown masked in repository reports. No key is ever tested against its provider.

What it does not flag

Click the password reset link: not flagged. "reset" is an ordinary word: no digit, no mixed case.
A password is required: not flagged. "required" is a recognised non-value.

If it already leaked

Change the password, and if it was reused anywhere else, change it there too. Then delete the message or ticket where it was written.

What Redaxa adds to every finding of this kind: If genuine, revoke or rotate it at the issuing service, update the application, then remove the exposed value from code and review Git history. Deleting it from Git does not revoke access.

Step by step: pasted a key into ChatGPT, or committed one to GitHub.

Check before you paste

The free Chrome extension runs this check inside ChatGPT, Claude, Gemini and Perplexity before a message is sent, on your device and with no daily limit. On the web you get 5 free prompt checks a day with no account.

Add the Chrome extension Try a free web check

Worried it is already in your code? Check a public GitHub repository free (3 checks a day).

Sources

Redaxa engine: scanner.ts line 249, credential-context.ts line 28 (Unknown service). Every output on this page was produced by that code when the page was built.
OWASP Secrets Management Cheat Sheet