# Secret scanning

Canonical page: /glossary/secret-scanning

API keys & secrets glossary, Mistakes & leaks. Secret Scanning: Catching Leaked Keys Automatically

**Short answer:** Secret scanning is an automated check, run by tools like GitHub's built-in scanner or standalone tools such as gitleaks, that searches a codebase and its commit history for patterns matching known secret formats, such as an API key prefix, and flags or blocks them.

## Why it matters

Many providers, including Anthropic and most major cloud platforms, partner with GitHub's secret scanning so a key matching their known format is automatically flagged, and in some cases automatically revoked, the moment it is pushed publicly.

## In Claude Keychain

Secret scanning is a safety net for when a secret ends up in a file; Claude Keychain's approach is to reduce how often that file exists in the first place, so the two work well together rather than instead of each other.

## Common questions

**Does secret scanning stop a leak from happening?**

It can catch it very quickly after the fact, and some setups block the push entirely, but the value should still be treated as compromised once it is flagged.

**Do I need to set up secret scanning myself?**

Many git hosting platforms enable a baseline version by default, though dedicated tools offer more thorough coverage.

## Related

[Secret leaked in git history](/glossary/secret-in-git-history), [Hardcoded secret](/glossary/hardcoded-secret), [Revoking an API key](/glossary/revoke-api-key)