CI/CD security

CI/CD secret scanning that gates the build

In short

Extuno scans code for leaked credentials with 1000+ anchored detectors, returns SARIF, and fails the build when a real secret is found - on every pull request, with git-history and baseline support.

What is CI/CD secret scanning?

It is checking a codebase for exposed credentials - API keys, tokens, private keys, database passwords - before they ship. Run as a gate in continuous integration, it blocks a pull request that introduces a leak instead of finding it after it is public.

How does Extuno keep false positives low?

Every detector is anchored to a provider's real token format or a keyword-plus-structure pattern, not a bare high-entropy guess. That precision is what lets a leak fail a build without flooding developers with noise that they learn to ignore.

How does it fit a pipeline?

Extuno emits SARIF, so results show up as inline annotations in GitHub, GitLab, and Azure. A pass or fail gate runs on every pull request, and git-history plus baseline support catch secrets committed earlier or let you accept a reviewed finding.

FAQ

Common questions

What formats does the CI gate output?

SARIF 2.1.0 for inline code-review annotations, plus a simple pass or fail gate result your pipeline can act on.

Does it scan git history?

Yes. It can scan historical commits to catch a secret that was committed and later removed but is still in the history, and supports a baseline to accept known findings.

Secret leak (glossary)

/glossary

Features

/features

npm package security

/npm-package-security