> For the complete documentation index, see [llms.txt](https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/reference/supported-secret-types.md).

# Supported Secret Types

What Heeler's secret detection covers — the rule set, confidence tiers, and live credential validation.

Heeler scans source and git history for exposed credentials across **700+ detection and validation rules**, spanning 20+ languages and config formats. This page describes what's covered; for how to work secret findings, see [Secrets](/mrecEO40m5D6bt7Pq5pE/findings/secrets.md).

## Two layers of detection

<table><thead><tr><th width="260">Layer</th><th>What it catches</th><th width="150">Confidence</th></tr></thead><tbody><tr><td><strong>Provider-specific rules</strong></td><td>Credentials with a recognizable shape for a known provider — cloud keys, SaaS API tokens, and the like.</td><td>High / Medium</td></tr><tr><td><strong>Generic entropy detection</strong></td><td>High-entropy strings that look like secrets but don't match a known provider pattern.</td><td>Low</td></tr></tbody></table>

## What's covered

Rules span the credential types you'd expect across a modern stack. The **Live-validated** column shows where Heeler checks a detected credential against the provider to confirm whether it's still active (see [Live validation](#live-validation)). Raw key material with nothing to probe is **assumed valid** rather than left unknown; everything else is detected and reported with its confidence.

<table><thead><tr><th width="220">Category</th><th>Representative providers</th><th width="150">Live-validated?</th></tr></thead><tbody><tr><td><strong>Cloud provider keys</strong></td><td>AWS, GCP, Azure, Azure Storage, DigitalOcean, Cloudflare, Alibaba</td><td>AWS, GCP, Azure Storage ✓</td></tr><tr><td><strong>Source &#x26; CI/CD tokens</strong></td><td>GitHub, GitLab, Bitbucket, Azure DevOps, CircleCI, Buildkite, Artifactory</td><td>GitHub ✓</td></tr><tr><td><strong>SaaS &#x26; AI API keys</strong></td><td>Slack (token &#x26; webhook), OpenAI, Anthropic, Google (Gemini/YouTube), Datadog, Stripe, Twilio, Hugging Face, Discord</td><td>Slack, OpenAI, Anthropic, Google/YouTube, Datadog ✓</td></tr><tr><td><strong>Datastore credentials</strong></td><td>PostgreSQL, MySQL, MongoDB, ClickHouse, generic DB connection strings &#x26; passwords</td><td>PostgreSQL, MySQL, MongoDB ✓ (connection test)</td></tr><tr><td><strong>Private keys &#x26; certificates</strong></td><td>SSH private keys, TLS/PEM private keys</td><td>Assumed Valid (Key Material) — treated as live</td></tr><tr><td><strong>Generic / high-entropy</strong></td><td>Credential-shaped strings that don't match a known provider pattern, including high-entropy API keys and password assignments</td><td>Detection only</td></tr></tbody></table>

The catalog covers hundreds of provider patterns beyond those listed above; the providers named here are representative of each category.

## Live validation

For many providers, Heeler goes beyond pattern matching and **validates** a detected credential against the provider to determine whether it's still live. The scanner records one of nine underlying statuses, and Heeler maps each status to one of five action buckets:

| Status                                 | Meaning                                                                                                      |
| -------------------------------------- | ------------------------------------------------------------------------------------------------------------ |
| **Active Credential**                  | The credential works — exploitable right now. Bucketed as **Rotate Now**.                                    |
| **Assumed Valid (Not Live-Validated)** | Real key material — a private key, for example — with no provider endpoint to probe. Bucketed as **Rotate**. |
| **Locally Derived**                    | Real key material Heeler can tell was generated locally. Bucketed as **Rotate**.                             |
| **Inactive Credential**                | Tested and no longer valid. Bucketed as **No Action**.                                                       |
| **Invalid Cryptographic Material**     | Structurally a key, but not valid material. Bucketed as **No Action**.                                       |
| **Not Attempted**                      | No validator applies to this credential class. Bucketed as **Triage**.                                       |
| **Inconclusive Validation**            | The check ran but did not settle the question. Bucketed as **Triage**.                                       |
| **Validation Skipped**                 | The check was deliberately not run. Bucketed as **Triage**.                                                  |
| **Canary Token (Skipped)**             | A deliberately planted token. Bucketed as **Expected**.                                                      |

Triage works from the five action buckets rather than the raw status — see [Secrets](/mrecEO40m5D6bt7Pq5pE/findings/secrets.md#the-five-action-buckets).

Provider-specific validation covers major cloud, source, SaaS, and AI providers (for example Slack, AWS, GitHub, OpenAI, Anthropic, Google/Gemini, GCP, Datadog, and Azure Storage), and database connection strings are checked by **testing the connection**. Where a provider isn't validated, Heeler still reports the finding with its confidence.

Verdicts don't go stale: a **Rotate Now** finding is re-verified **daily**, every other verdict **weekly**, and any finding can be re-checked on demand — see [Verdicts stay current](/mrecEO40m5D6bt7Pq5pE/findings/secrets.md#verdicts-stay-current).

{% hint style="info" %}
The action bucket is the primary secret-prioritization signal; detection confidence helps order manual review within the no-verdict queue. See [How secrets are prioritized](/mrecEO40m5D6bt7Pq5pE/findings/secrets.md#how-secrets-are-prioritized). You can also tune what's reported per repository (ignored confidences, rule IDs, and file paths) in the repository's secret settings.
{% endhint %}

## Related

* [Secrets](/mrecEO40m5D6bt7Pq5pE/findings/secrets.md) — triaging, validating, and excepting secret findings.
* [Secrets Guardrails](/mrecEO40m5D6bt7Pq5pE/prevent/pr-guardrails/guardrail-types/secrets-guardrails.md) — block secrets at the pull request.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/reference/supported-secret-types.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.