Secrets

The Secrets tab scans captured traffic for credentials and personal data that shouldn’t be there: AWS, GitHub, Stripe, Slack, OpenAI, Anthropic and Google keys, private keys, JSON Web Tokens outside the Authorization header, card numbers, credentials in URLs, and passwords sent over plain HTTP. Use it to catch a key your app ships to clients, a token that ends up in server logs, or a payment form posting over HTTP.

Values are always masked in the window, so you can review findings on a shared screen.

1234

Each finding shows what was found, where, a masked value, the host and the request number.

1. Show all findings, Medium and high, or High only
2. Where the value was found
3. The masked value
4. Values are masked; export with Redact secrets to share

×

Review findings

1. Open Insights with ⌥ ⌘ I and click Secrets.
2. Use Show to pick All, Medium and high or High only.
3. Select a finding. A tip appears under the table explaining the risk and what to do, with a Show Request button.
4. Click Show Request to select the request in the main window and inspect it.
5. Fix the leak in your app or backend, and rotate any real key that was exposed.

Findings are sorted by severity, then by request number. The same value found twice in the same place of the same request is listed once.

If nothing is found, the tab says No secrets found.

Table columns

Column	What it shows
(badge)	Severity: High, Medium or Low.
Kind	What was found, such as AWS access key or Credential in URL.
Where	The location, plus the header name, query parameter or JSON key when known, such as Request header · X-Api-Key.
Value	The masked value.
Host	The request’s host.
#	The request number in the traffic list.

Locations

Location	What’s scanned
URL	The full request URL and each query parameter.
Request header	Every request header except Authorization, Proxy-Authorization, Cookie and Set-Cookie.
Request body	The request body, decoded.
Response header	Every response header except the four above.
Response body	The response body, decoded.

Bodies are decoded first (gzip, deflate and Brotli), and up to the first 1,000,000 bytes of text are scanned. Binary bodies that aren’t UTF-8 text are skipped.

Authorization, Proxy-Authorization, Cookie and Set-Cookie exist to carry credentials, so a token there isn’t reported as a leak, except over plain HTTP (see below).

What the scanner detects

Keys and tokens by shape

These are found anywhere in a URL, header or body:

Kind	Severity	Matches
AWS access key	High	AKIA or ASIA followed by 16 capital letters or digits.
GitHub token	High	ghp_, gho_, ghu_, ghs_ or ghr_ followed by 36 letters or digits, or github_pat_ followed by 22 or more characters.
Stripe secret key	High	sk_live_ or rk_live_ followed by 16 or more letters or digits. Test-mode keys (sk_test_…) aren’t flagged.
Slack token	High	xoxa-, xoxb-, xoxp-, xoxr- or xoxs- followed by 10 or more characters.
Anthropic API key	High	sk-ant- followed by 20 or more characters.
OpenAI API key	High	sk- or sk-proj- followed by 20 or more letters or digits.
Private key	High	A PEM header: -----BEGIN PRIVATE KEY-----, or the RSA, EC, OPENSSH, DSA or ENCRYPTED variants.
Card number	High	14 to 16 digits starting with 3, 4, 5 or 6, optionally grouped in fours with spaces or dashes, or a 15-digit American Express layout (4-6-5) starting with 34 or 37. The number must pass the Luhn checksum and can’t be one repeated digit.
Google API key	Medium	AIza followed by 35 characters.
JSON Web Token	Medium	Three base64url segments where the first two start with eyJ. Because Authorization isn’t scanned, this finds tokens outside it: in URLs, other headers and bodies.

A Medium finding in a URL is raised to High, because URLs end up in server logs, proxies and browser history.

Credentials in URLs

Kind	Severity	When it’s reported
Credential in URL	High	A query parameter with a credential name (listed below) has a value. The Where column shows the parameter name.
Email address in URL	Low	A query parameter’s value contains an email address.

If a specific pattern above already matched the same value, such as a Stripe key in ?api_key=, only the specific finding is listed.

Credentials over plain HTTP

Kind	Severity	When it’s reported
Credentials over plain HTTP	High	A request over http to a non-local host carries an Authorization or Cookie header, or its JSON or form-encoded body has a field with a credential name and a value.

Local hosts are exempt: localhost, addresses starting with 127., ::1, and names ending in .local or .localhost.

Credential names

Query parameters, JSON keys and form fields count as credentials when their whole name is one of these, in any case:

pass, password, passwd, pwd, secret, client_secret, api_key, api-key, apikey, access_token, access-token, accesstoken, auth_token, auth-token, authtoken, refresh_token, refresh-token, refreshtoken, id_token, token, session_id, session-id, sessionid, private_key, private-key, privatekey, ssn, cvv, cvc.

How values are masked

The window, the Markdown report and the MCP server only ever show a masked version of a value:

Value length	Masked as	Example
More than 8 characters	The first 4 characters, …, the last 2, and the length	AKIA…LE (20 chars)
8 characters or fewer	Bullets only, at least four	••••••

That’s enough to recognize which key it is, and not enough to use it.

Values that were already replaced with REDACTED by redaction aren’t reported again. This means you can scan a redacted export to check that nothing slipped through.

Masking is on screen only

The real value is still in the captured request, and in any session, HAR or other file you export without redaction. Turn on Redact secrets when you export or publish, and treat any real key found here as compromised: rotate it.

Advice for each kind

Selecting a finding shows a tip:

Kind	Tip
AWS, GitHub, Stripe, Slack, Anthropic and OpenAI keys	Rotate the key and keep it on the server; anything shipped to a client can be extracted.
Private key	A private key should never travel over the network to a client.
Google API key	Restrict the key to your app’s bundle ID or referrer in the Google Cloud console.
JSON Web Token	Tokens outside the Authorization header end up in logs and caches.
Card number	Card numbers should only go to a PCI-compliant payment provider.
Credential in URL	Send it in a header or the body instead.
Email address in URL	Personal data in URLs ends up in logs and referrers.
Credentials over plain HTTP	Anyone on the network can read it. Use HTTPS.

Secrets in CI, the report and MCP

• The Markdown report lists up to 100 findings with severity, kind, location, host, request number and masked value. See Insights report.
• cloakctl run --fail-on-secrets exits with status 1 when a run captured any High-severity secret. See Headless and CI.
• The MCP server’s insights tool returns masked findings with section set to secrets.

Limits

The scanner looks for the formats listed on this page. It won’t recognize every vendor’s key format, secrets in binary or encrypted payloads, or personal data other than email addresses in URLs and the credential names above. Review sensitive traffic yourself as well.

Related

Find leaked secretsA walkthrough from capture to fix.

RedactionExactly what Redact secrets removes.

SecurityHeader and cookie grades per host.

Headless and CIFail a build when secrets leak.