Secret Scan
Surface repository secret risk and whether raw values can reach a detected agent.
fida scan is the risk lens for Fida's secret-leak-prevention promise. It finds exposed credentials, checks whether they are tracked by git, and reports whether a raw value could still reach a detected agent. It is local-only and never emits a secret value, its length, or any fragment of it.
Scan for risk
fida scan
fida scan --path ./service
fida scan --json
fida scan --fail-on high
fida scan --include-ignored
fida scan --exclude vendorWhat it checks per discovered file:
| Signal | Meaning |
|---|---|
| Sensitive file | Name matches .env, .env.*, *.pem, *.key, id_rsa, or id_ed25519. |
| Hardcoded secret | A provider key or private-key block appears in a regular source file. |
| Content match | The built-in secret detector matched content (files up to 5 MiB are scanned). |
| Git tracked | The file is tracked by git, which makes a committed exposure more urgent. |
| Protection | Weakest detected agent path: enforced, best_effort, incomplete, or inactive. |
| Raw secret exposure | Whether an unredacted value could reach a model. |
Risk levels:
high— a secret is git-tracked, or a detected agent has raw-secret exposure.medium— a secret exists, but its model-bound path is redacted or blocked.low— no sensitive files, content matches, or hardcoded secrets were found.
Fida never traverses default build and dependency directories such as .git, target, node_modules, dist, build, and .next. Ordinary ignored files are skipped for performance, while sensitive filenames remain included because they are the files agents must never receive raw. Use --include-ignored for the broader ignored tree.
Protection-aware output
The important field is raw_secret_exposure, not whether an agent can read a file at all. A redacted safe view remains useful to an agent without disclosing the credential.
{
"risk": "medium",
"protection": "enforced",
"raw_secret_exposure": false,
"findings": [
{
"path": ".env",
"sensitive": true,
"protection": "enforced",
"raw_secret_exposure": false
}
]
}Detector catalog
The scanner uses the same detector catalog as the redacting gateway: dotenv KEY=value assignments, PEM private-key blocks, and high-precision AWS, GitHub, Google, Slack, Stripe, OpenAI, Anthropic, and JWT formats. It also scans ordinary source files for hardcoded provider keys. For commit history and broader detection, pair Fida with a dedicated scanner such as gitleaks or GitGuardian.