Secret Leaks
Secret Leaks lists secrets linked to one of your domains that StyxView found exposed in public sources: API keys, access tokens, passwords, private keys, connection strings, and similar values. Each row is a finding of the type "Secret Leaks". Rotate or revoke an exposed secret, then update the finding's status.
Where to find it
Section titled “Where to find it”Select "Company Protection" > "Data Leakage & Dark Web Detection" > "Secret Leaks".
Columns
Section titled “Columns”| Column | What it shows |
|---|---|
| "ID" | The finding ID. |
| "Added Date" | When StyxView found the secret. |
| "Secret Type" | The kind of secret. See Secret types. |
| "Secret Value" | The secret, in full, as found. |
| "Status" | The finding status. See Finding statuses. |
| "Source" | The address where the secret was found. Copy it or open it from the cell. |
| "Assigned User" | The user the finding is assigned to. |
| "Latest Comment" | The most recent comment on the finding. |
The list opens filtered to open finding statuses.
Working with findings
Section titled “Working with findings”Select one or more rows, then select "Actions" for "Update Status", "Assign To", "Comment", or "Mark as False Positive". See Finding statuses and User Actions.
Select a row to open the finding's page, which shows "Date Discovered", "Secret Type", "Secret Value", "Source", and "Status". To export the list, select the export icon, then "Download as CSV" or "Download as Excel".
Secret types
Section titled “Secret types”StyxView detects the types of secret below. They appear in "Secret Type" spelled exactly as listed.
| Group | Secret types |
|---|---|
| Amazon Web Services | AWS Access Key ID Value, AWS Account ID, AWS Secret Access Key, AWS Session Token, AWS cred file info, Amazon MWS Auth Token, and s3-buckets |
| Microsoft Azure | Azure Entra - Tenant ID, Azure Entra - Client ID, Azure Entra - Client Secret, Azure Storage Connection String, Azure-OpenAI - Endpoint, and Azure-OpenAI - API Key |
| Google (GCM) Service account, Google OAuth Key, Google OAuth Access Token, Google Cloud API Key, google-cloud-key, google-drive-key, and Google Captcha | |
| OpenAI | OpenAI Admin Key and OpenAI Legacy Key |
| Code, build, and developer tools | Artifactory, artifactory-password, artifactory-token, CodeClimate, Github Key, GitHub Token, Heroku API key, HockeyApp, NuGet API Key, Postman API Key, Sauce Token, SonarQube Docs API Key, and StackHawk API Key |
| Payments | PayPal/Braintree Access Token, Picatic API key, Square Access Token, Square OAuth Secret, and Stripe API key |
| Email and messaging | MailChimp API Key, MailGun API Key, SendGrid API Key, Twilo API Key, Slack Token, Slack Webhook, Outlook team, and mailto |
| Social media | Facebook access token, Facebook Client ID, Facebook Secret Key, Linkedin Client ID, LinkedIn Secret Key, linkedin-id, Twitter Client ID, and Twitter Secret Key |
| Passwords, tokens, and keys | Basic Auth, Bearer Token (Generic), Bearer Token (JWT), JWT Token, Password in JSON, SSH Password, Username and password in URI, URL with Credentials, Contains a private key, and cloudinary-basic-auth |
| Databases | MongoDB Connection String and Postgres/MySQL/Redis Connection String |
| Configuration and network | WP-Config, Internal Domain, and Private IPv4 |