secret-handling

Secret scanning during code review detects and blocks hardcoded credentials, API keys, and tokens before they ship. It validates that sensitive values come from an approved secret store and traces sinks to prevent exposure in logs, telemetry, or prompts.

Sink tracing for credential security works by tracking how sensitive values flow through code to ensure they never reach logs, error responses, telemetry, serialized state, or long-lived storage. It blocks changes that touch credential flows or auth configurations outside approved stores.

Yes, you can use this to inspect authentication flows and crypto material. It acts as a security gate that blocks changes touching credential flow, auth configuration, or secret-bearing integrations if any sensitive value is exposed in test fixtures, debugging statements, or stored outside the approved store.

The best way to verify secrets come from an approved secret store is to apply automated source validation during code changes. This checks that every sensitive value originates from the approved store rather than literals, environment variables, or unapproved backends before allowing the commit.

Your code review fails because secret-handling policies block changes where sensitive values appear in test fixtures, debugging statements, or LLM prompts. The security gate requires reviewer confirmation and request-bound containment to ensure no credentials are exposed outside the approved store.

You need secret scanning for LLM prompts and telemetry whenever code changes read, write, store, log, or transmit credentials, tokens, or certificates. It traces sinks to ensure sensitive values never reach prompts, telemetry, serialized state, or long-lived storage outside the approved store.