Secret Scanning

Secret Scanning finds hardcoded secrets that have been left behind in local files on your team's devices, such as shell history files (.zsh_history, .bash_history), AI coding agent sessions, and credential files, and helps you clean them up. It's easy to accidentally leak an API key or token into your shell history by pasting a curl command or an environment variable, and those secrets can sit there for months.

The scan runs entirely on the device. It surfaces every finding so a developer can review it and remediate it directly on their own machine.

It doesn't crawl the whole disk. It only looks at the places secrets tend to pile up, such as history files and credential files. See What gets scanned for the full list.

How it works

Secret Scanning is designed so that your secret values stay on the device.

• Scanning is fully local. The agent reads and inspects files on the device itself. File contents are never uploaded to Aikido.
• Secret values stay on the device. The full value of a detected secret is never transmitted. In the desktop client it is shown masked (for example [AIK********...]) so you can recognize it without exposing it.
• Only the secret type and a few characters are reported. Aikido receives the type of secret that was found (for example "authorization token") and a few characters of the value, enough for you to recognize the finding. The full secret is never sent. This gives your organization visibility into what kinds of secrets are being exposed, without handing over the secrets themselves.

flowchart LR
    A[Files on device<br/>e.g. .zsh_history] --> B[On-device scan]
    B --> C[Findings shown locally<br/>file, type, masked preview]
    B --> D[Secret type and a few<br/>characters reported to Aikido]

    classDef local fill:#d6f5d6,stroke:#27ae60;
    classDef cloud fill:#fff2cc,stroke:#e1a100;
    class C local;
    class D cloud;

Reviewing detected secrets

Open the Secrets tab in the desktop client to see everything the agent has found. The tab shows a count of the total number of secrets detected.

Each finding shows:

• Type - A description of what was detected, for example "Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource."
• Location - The file and line where the secret was found, for example /Users/samuel/.zsh_history:370. When the same type of secret appears in multiple places, they are grouped together (for example, "and 8 more"). Expand the row to see every occurrence.
• Value - The detected secret, always masked.

Cleaning up secrets

You can remediate secrets one at a time or in bulk.

• One by one - Click the erase icon on a finding to clean that individual secret.
• In bulk - Use the checkboxes to select multiple findings, or select all secrets of a specific type, then clean them in a single action.

Cleaning removes the secret from the file on the device.

Cleanup is only available for the rewritable categories, shell history and AI agent sessions. Findings in credential files, cloud credentials, and AI tool credentials are reported but left untouched, so remediate those by rotating the credential and updating the config file yourself. To stop those credentials from landing back in plaintext, see Storing Secrets Safely.

What gets scanned

Findings fall into five categories. Shell history and AI agent sessions can be cleaned up in place. The three credential categories are detect-only: those files are configuration that your tools read back, so Aikido reports what it finds but never rewrites them.

All paths below are relative to the user's home directory