Detected secrets
- Tier: Free, Premium, Ultimate
- Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated
This table lists the secrets detected by:
- Pipeline secret detection
- Client-side secret detection
- Secret push protection
Secret detection rules are updated in the default ruleset. Detected secrets with patterns that have been removed or updated remain open so you can triage them.
| Description | ID | Pipeline secret detection | Client-side secret detection | Secret push protection |
|---|---|---|---|---|
| Adafruit IO Key | AdafruitIOKey | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Adobe Client ID (OAuth Web) | Adobe Client ID (Oauth Web) | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Adobe client secret | Adobe Client Secret | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Age secret key | Age secret key | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Aiven Service Password | AivenServicePassword | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Alibaba AccessKey ID | Alibaba AccessKey ID | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Alibaba Secret Key | Alibaba Secret Key | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Anthropic API key | anthropic_key | {check-circle} Yes | {check-circle} Yes | {check-circle} Yes |
| Artifactory API Key | ArtifactoryApiKey | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Artifactory Identity Token | ArtifactoryIdentityToken | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Asana client ID | Asana Client ID | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Asana client secret | Asana Client Secret | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Asana Personal Access Token V1 | AsanaPersonalAccessTokenV1 | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Asana Personal Access Token V2 | AsanaPersonalAccessTokenV2 | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Atlassian API Key | AtlassianApiKey | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Atlassian API token | Atlassian API token | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Atlassian User API Token | AtlassianUserApiToken | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| AWS access token | AWS | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Azure Entra Client Secret | AzureEntraClientSecret | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Beamer API token | Beamer API token | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Bitbucket client ID | Bitbucket client ID | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Bitbucket client secret | Bitbucket client secret | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Brevo API token | Sendinblue API token | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Brevo SMTP token | Sendinblue SMTP token | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| CircleCI access token | CircleCI access tokens | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| CircleCI Personal Access Token | CircleCIPersonalAccessToken | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Clojars deploy token | Clojars API token | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Contentful delivery API token | Contentful delivery API token | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Contentful personal access token | ContentfulPersonalAccessToken | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Contentful preview API token | Contentful preview API token | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Databricks API token | Databricks API token | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| DigitalOcean OAuth access token | digitalocean-access-token | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| DigitalOcean personal access token | digitalocean-pat | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| DigitalOcean refresh token | digitalocean-refresh-token | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Discord API key | Discord API key | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Discord client ID | Discord client ID | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Discord client secret | Discord client secret | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Docker Personal Access Token | DockerPersonalAccessToken | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Doppler API token | Doppler API token | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Doppler Service token | Doppler Service token | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Dropbox API secret/key | Dropbox API secret/key | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Dropbox long lived API token | Dropbox long lived API token | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Dropbox short lived API token | Dropbox short lived API token | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Duffel API token | Duffel API token | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Dynatrace Platform Token | DynatracePlatformToken | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| EasyPost production API key | EasyPost API token | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| EasyPost test API key | EasyPost test API token | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Facebook token | Facebook token | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Fastly API user or automation token | Fastly API token | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Figma Personal Access Token | FigmaPersonalAccessToken | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Finicity API token | Finicity API token | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Finicity client secret | Finicity client secret | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Flutterwave test encrypted key | Flutterwave encrypted key | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Flutterwave test public key | Flutterwave public key | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Flutterwave test secret key | Flutterwave secret key | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Frame.io API token | Frame.io API token | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| GCP API key | GCP API key | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| GCP OAuth client secret | GCP OAuth client secret | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| GitHub app token | Github App Token | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| GitHub App Installation Token | GithubAppInstallationToken | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| GitHub Fine Grained Personal Access Token | GithubFineGrainedPersonalAccessToken | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| GitHub OAuth Access Token | Github OAuth Access Token | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| GitHub personal access token (classic) | Github Personal Access Token | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| GitHub refresh token | Github Refresh Token | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| GitLab CI/CD job token | gitlab_ci_build_token | {check-circle} Yes | {check-circle} Yes | {dotted-circle} No |
| GitLab deploy token | gitlab_deploy_token | {check-circle} Yes | {check-circle} Yes | {dotted-circle} No |
| GitLab Feature Flags Client Token | None | {dotted-circle} No | {check-circle} Yes | {dotted-circle} No |
| GitLab feed token | gitlab_feed_token | {check-circle} Yes | {check-circle} Yes | {dotted-circle} No |
| GitLab feed token v2 | gitlab_feed_token_v2 | {check-circle} Yes | {check-circle} Yes | {check-circle} Yes |
| GitLab incoming email token | gitlab_incoming_email_token | {check-circle} Yes | {check-circle} Yes | {check-circle} Yes |
| GitLab Kubernetes agent token | gitlab_kubernetes_agent_token | {check-circle} Yes | {check-circle} Yes | {check-circle} Yes |
| GitLab OAuth application secret | gitlab_oauth_app_secret | {check-circle} Yes | {check-circle} Yes | {check-circle} Yes |
| GitLab personal access token | gitlab_personal_access_token | {check-circle} Yes | {check-circle} Yes | {check-circle} Yes |
| GitLab Personal Access Token (routable) | gitlab_personal_access_token_routable | {check-circle} Yes | {check-circle} Yes | {check-circle} Yes |
| GitLab pipeline trigger token | gitlab_pipeline_trigger_token | {check-circle} Yes | {check-circle} Yes | {check-circle} Yes |
| GitLab runner authentication token | gitlab_runner_auth_token | {check-circle} Yes | {check-circle} Yes | {check-circle} Yes |
| GitLab runner registration token | gitlab_runner_registration_token | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| GitLab SCIM OAuth token | gitlab_scim_oauth_token | {check-circle} Yes | {check-circle} Yes | {dotted-circle} No |
| GoCardless API token | GoCardless API token | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Google (GCP) service account | Google (GCP) Service-account | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Grafana API token | Grafana API token | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| HashiCorp Terraform API token | Hashicorp Terraform user/org API token | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| HashiCorp Vault batch token | Hashicorp Vault batch token | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Heroku API key or application authorization token | Heroku API Key | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Highnote Live Secret Key | HighnoteLiveSecretKey | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Highnote Test Secret Key | HighnoteTestSecretKey | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| HubSpot private app API token | Hubspot API token | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Hugging Face User Access Token | HuggingFaceUserAccessToken | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Instagram access token | Instagram access token | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Intercom API token | Intercom API token | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Intercom client secret or client ID | Intercom client secret/ID | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Ionic personal access token | Ionic API token | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Linear API token | Linear API token | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Linear client secret or ID (OAuth 2.0) | Linear client secret/ID | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| LinkedIn client ID | Linkedin Client ID | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| LinkedIn client secret | Linkedin Client secret | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Lob API key | Lob API Key | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Lob publishable API key | Lob Publishable API Key | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Mailchimp API key | Mailchimp API key | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Mailgun private API token | Mailgun private API token | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Mailgun public verification key | Mailgun public validation key | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Mailgun webhook signing key | Mailgun webhook signing key | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Mapbox API token | Mapbox API token | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| MaxMind License Key | MaxMind License Key | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| MessageBird access key | messagebird-api-token | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| MessageBird API client ID | MessageBird API client ID | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Meta access token | Meta access token | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| New Relic ingest browser API token | New Relic ingest browser API token | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| New Relic ingest browser API token v2 | New Relic ingest browser API token v2 | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| New Relic REST API Key | New Relic REST API Key | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| New Relic user API ID | New Relic user API ID | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| New Relic user API key | New Relic user API Key | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| npm access token | npm access token | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Oculus access token | Oculus access token | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Onfido Live API Token | Onfido Live API Token | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| OpenAI API key | open ai token | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Password in URL | Password in URL | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| PGP private key | PGP private key | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| PKCS8 private key | PKCS8 private key | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| PlanetScale API token | Planetscale API token | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| PlanetScale App Secret | PlanetscaleAppSecret | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| PlanetScale OAuth Secret | PlanetscaleOAuthSecret | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| PlanetScale password | Planetscale password | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| PostHog Personal API key | PostHogPersonalAPIkey | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| PostHog Project API key | PostHogProjectAPIkey | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Postman API token | Postman API token | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Pulumi API token | Pulumi API token | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| PyPi upload token | PyPI upload token | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| RSA private key | RSA private key | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| RubyGems API token | Rubygem API token | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Segment public API token | Segment Public API token | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| SendGrid API token | Sendgrid API token | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Shippo API token | Shippo API token | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Shippo Test API token | Shippo Test API token | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Shopify custom app access token | Shopify custom app access token | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Shopify personal access token | Shopify access token | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Shopify private app access token | Shopify private app access token | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Shopify shared secret | Shopify shared secret | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Slack app level token | SlackAppLevelToken | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Slack bot user OAuth token | Slack token | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Slack webhook | Slack Webhook | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| SonarQube Global Analysis Token | SonarQubeGlobalAnalysisToken | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| SonarQube Project Analysis Token | SonarQubeProjectAnalysisToken | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| SonarQube User Token | SonarQubeUserToken | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| SSH (DSA) private key | SSH (DSA) private key | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| SSH (EC) private key | SSH (EC) private key | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| SSH private key | SSH private key | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Stripe live restricted key | StripeLiveRestrictedKey | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Stripe live secret key | StripeLiveSecretKey | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Stripe Live Short Secret Key | StripeLiveShortSecretKey | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Stripe publishable live key | StripeLivePublishableKey | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Stripe publishable test key | StripeTestPublishableKey | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Stripe restricted test key | StripeTestRestrictedKey | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Stripe secret test key | StripeTestSecretKey | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Stripe Test Short Secret Key | StripeTestShortSecretKey | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Tailscale key | Tailscale key | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Tencent Cloud Secret ID | TencentCloudSecretID | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Twilio Account SID | Twilio Account SID | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Twilio API key | Twilio API Key | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| Twitch OAuth client secret | Twitch API token | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Typeform personal access token | Typeform API token | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Volcengine Access Key ID | VolcengineAccessKeyID | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| WakaTime API Key | WakaTimeAPIKey | {check-circle} Yes | {dotted-circle} No | {check-circle} Yes |
| X token | Twitter token | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Yandex.Cloud AWS API compatible access secret | Yandex.Cloud AWS API compatible Access Secret | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Yandex.Cloud API Key | Yandex.Cloud API Key | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Yandex.Cloud IAM cookie v1-1 | Yandex.Cloud IAM Cookie v1 - 1 | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |
| Yandex.Cloud IAM cookie v1-3 | Yandex.Cloud IAM Cookie v1 - 3 | {check-circle} Yes | {dotted-circle} No | {dotted-circle} No |