Find leaked secrets

Before you ship, you want to know if your app is sending API keys to the client, putting tokens in URLs, or exposing card numbers. This guide captures your app’s traffic, runs the Insights secret and PII scanner over it, reviews the security header grades, and exports a redacted report you can share.

What you need

Cloak Proxy capturing your app, with HTTPS decrypted	The scanner reads decrypted request and response bodies
A representative session: sign in, load the main screens, do a purchase if there is one	More traffic means more coverage

Caution

Scan only traffic from apps you own or are authorized to test. Findings include masked secret values; the full values are never shown, but the requests they came from still contain them until you redact.

Capture a representative session

1. Turn on capture and decrypt your app’s host (see Debug a mobile app for a device, or macOS traffic for a Mac app).

2. Exercise the app: sign in, open the screens that load data, and run any flow that handles money or personal details. The scanner only sees what the app actually sends.

Run the secret scanner

1. Open Insights (<kbd>⌥</kbd> <kbd>⌘</kbd> <kbd>I</kbd>) and select the Secrets tab. Insights analyzes the captured traffic automatically.

   1234

   Leaked secrets, masked. Each row says what kind, where, and on which host.

   1. Filter by severity
   2. Kind and severity
   3. Where it was found
   4. Masked value — safe to read and share

   ×

   

2. Each row shows the Kind, Where it was found (URL, request/response header or body, with the key or parameter name), the masked Value, the Host, and the request number. Use the Show menu to filter by severity.

3. Select a finding to read its advice (for example, “Rotate this key and keep it on the server”), then click Show Request to jump to the exact request.

What it looks for

Finding	Severity	Notes
AWS, GitHub, Stripe, Slack, OpenAI, Anthropic, Google keys	High / Medium	Known key shapes; anything in a URL is raised to High
Private keys (-----BEGIN … PRIVATE KEY-----)	High	Should never reach a client
JSON Web Tokens outside the Authorization header	Medium	End up in logs and caches
Card numbers	High	Luhn-checked, so random digits don’t match
Credentials in URL parameters (?api_key=…, token=…)	High	URLs are logged everywhere
Credentials over plain HTTP (Authorization, Cookie, password fields)	High	Readable by anyone on the network
Email addresses in URLs	Low	PII in logs and referrers

Note

Values in the Authorization, Cookie and Set-Cookie headers over HTTPS are expected to carry credentials, so they aren’t reported as leaks there. The same credentials in a URL, a body, or over plain HTTP are flagged.

Check the security headers

The Security tab grades each host A–F on response header and cookie hygiene.

123

Per-host security grades and the issues behind them.

1. Hosts, worst grade first
2. Missing headers, weak cookies, risky CORS
3. Show Request to jump to it

×

1. Select a host to see its issues: missing HSTS, CSP, nosniff or clickjacking protection; cookies without Secure, HttpOnly or SameSite; wildcard CORS with credentials; and disclosed software versions.

2. Click Show Request(s) on an issue to see the responses it came from.

Share the findings safely

Export the findings without the secrets.

Insights report

Click Export Report in the Insights toolbar to save a Markdown report (endpoints, errors, secrets, security grades, schema changes) for a pull request, ticket or CI log. Secret values in the report are masked.

Redacted session

Right-click a selection (or export all) and choose Export Request → HAR…, then tick Redact secrets in the save panel. Redaction removes tokens, cookies, API-key headers, credential parameters, password-like fields, and anything the scanner matches.

Danger

A plain HAR file contains real cookies, tokens and bodies. Never share an un-redacted HAR. Tick Redact secrets before exporting, and the same before Publish to GitHub Gist… (where redaction is on by default).

Fix and re-check

1. Move client-exposed keys to the server, take credentials out of URLs, and add the missing security headers.

2. Capture a fresh session and open Insights again. The Overview tab shows Possible secrets and the Worst security grade at a glance, so you can confirm they dropped.

   123

   The Overview tiles summarize secrets and the worst grade.

   1. Possible secrets count
   2. Worst security grade
   3. Needs attention: each finding with Show Request

   ×

   

Tip

For CI, cloakctl run --fail-on-secrets wraps a test command and exits non-zero if high-severity secrets are found. See Run API tests in CI and Headless and CI.

Related

SecretsThe full secret and PII scanner reference.

SecurityHow the A–F grades and checks work.

RedactionWhat redaction removes on export and share.

Publish to GistShare requests as a Gist, redacted by default.