Detection reference · Credentials and secrets · Updated 2026-11-03

Secrets in .env files and configuration values

Most secrets have no recognisable format: a database password or a JWT signing secret is just a string. What gives them away is the name they are assigned to, so that is what this rule reads.

At a glance

Reported as	Secret in a configuration value
Category	Credentials and secrets
Severity	critical: direct account or system compromise, as with keys, passwords and tokens
Replaced with	`[REDACTED]`
Where it runs	The same engine runs in the Chrome extension (free checks, on your device), in the web check and the Windows app (on Redaxa's server; the text is not stored) and in public repository checks.
Engine rule	scanner.ts, line 223

What it looks like

A setting whose name contains secret, token, password, pwd, _pass, api_key, access_key, private_key or auth_key, followed by = or : and a literal value of at least 8 characters with both a letter and a digit.

Example 1

You paste

DB_PASSWORD=RedaxaSample2026

Redaxa returns

DB_PASSWORD=[REDACTED]

Reported as	Secret in a configuration value
Severity	critical: direct account or system compromise, as with keys, passwords and tokens
Replaced with	`[REDACTED]`
Probable service	Unknown service
Credential type	Secret in a configuration value
Evidence	The value alone does not identify its owner or issuing service.
Recommended action	Identify owner, then rotate if genuine

Example 2

You paste

"apiKey": "RedaxaDocs2026SampleReda"

Redaxa returns

"apiKey": "[REDACTED]"

Reported as	Secret in a configuration value
Severity	critical: direct account or system compromise, as with keys, passwords and tokens
Replaced with	`[REDACTED]`
Probable service	Unknown service
Credential type	Secret in a configuration value
Evidence	The value alone does not identify its owner or issuing service.
Recommended action	Identify owner, then rotate if genuine

All values on this page are synthetic or published specimens; none is a working credential or a real person's data.

In a repository check

The same example, committed to a public repository and run through the free repository check:

config/production.json: Secret in a configuration value, listed as a reference, not counted as an exposure (severity info). Test or example value, counted but not listed. Real-looking keys in test files are still reported.
Same value in tests/fixtures/production.json: Test or example value, counted but not listed. Real-looking keys in test files are still reported.

Values are always shown masked in repository reports. No key is ever tested against its provider.

What it does not flag

DB_PASSWORD=${DB_PASSWORD}: not flagged. A variable reference, not a value.
apiKey: "process.env.API_KEY": not flagged. Code that reads the secret from the environment.
JWT_SECRET: changeme123: not flagged. changeme is recognised as a placeholder.
color_token: #ff0000aa: not flagged. A hex colour is not a secret, even under a name containing token.

If it already leaked

Change the secret where it is used (database, signing key, service), move it out of the file into a secret manager or untracked environment, and add the file to .gitignore.

What Redaxa adds to every finding of this kind: If genuine, revoke or rotate it at the issuing service, update the application, then remove the exposed value from code and review Git history. Deleting it from Git does not revoke access.

Step by step: pasted a key into ChatGPT, or committed one to GitHub.

Check before you paste

The free Chrome extension runs this check inside ChatGPT, Claude, Gemini and Perplexity before a message is sent, on your device and with no daily limit. On the web you get 5 free prompt checks a day with no account.

Add the Chrome extension Try a free web check

Worried it is already in your code? Check a public GitHub repository free (3 checks a day).

Sources

Redaxa engine: scanner.ts line 223, credential-context.ts line 28 (Unknown service). Every output on this page was produced by that code when the page was built.
OWASP Secrets Management Cheat Sheet