Most of the secret-scanning tools I've tried inspect repositories, configuration files, and deployment manifests. We use Vault and External Secrets Operator successfully for managing and syncing credentials, but they don't address a different problem: credentials embedded directly in an application's authentication behavior, such as an API key compiled into a binary or a token generated and attached by runtime code. Standard repository scans never find these cases. What tools or techniques can detect secrets at that layer, including during execution or when the application authenticates to another service?
2 Answers
If a credential is truly hardcoded in the application, it should still exist somewhere in the source, generated code, build artifacts, or compiled binary. I’d use layered checks: scan source and dependencies, inspect build outputs, search binaries for recognizable formats or high-entropy strings, and then monitor authentication traffic in a test environment. Runtime tracing can reveal values that are assembled dynamically and never appear as a complete string in the code.
Gitleaks and SonarQube are useful for source code and configuration, but they won’t reliably detect a credential that has been compiled into a binary or produced inside the application’s runtime authentication flow. For that case, instrument the running process or its outbound traffic—eBPF-based tracing, application instrumentation, or a controlled proxy can help inspect authentication requests and identify suspicious headers, tokens, and payloads. This is especially useful when the value never comes from a file or environment variable.
Exactly. The important distinction is whether the secret exists as a detectable source artifact or only appears after compilation or during execution. Static scanners cover the first case; runtime observation is needed for the second.