Secret Scanning — In Design
Secret scanning is not built yet.
There is no detection engine behind this page. No repository is fetched, cloned or read, and the scan endpoint is disabled rather than returning a result.
What is built, and what is planned
Built today: this page and a dashboard screen that tells you the engine is off. Everything below is design intent, not software you can use.
Planned: repository scanning
Detection of credentials committed to a Git repository, including history rather than only the current checkout. Not built — nothing reads your code today.
Planned: commit-time prevention
A local hook that stops a commit containing a credential before it reaches the remote. Not built, and not distributed as a package today.
Planned: finding triage
Ranking a finding by what the credential actually unlocks, so a live production key is not queued behind a dummy value in a test fixture. Not built — and we will not ship a severity we have not established.
Planned: rotation guidance
Service-specific steps to revoke and re-issue an exposed credential, and a record of what was rotated. Not built.
Frequently asked questions
Straight answers about where this product actually is.
Can I scan a repository today?
No. There is no detection engine behind this page. The scan endpoint is disabled and returns an error instead of a result — we would rather refuse than hand you a finding we did not measure.
What is actually built?
This page, a dashboard screen that tells you the engine is not enabled, and the data model behind it. No repository is fetched, cloned or read; no code of yours reaches us.
Why was the scan endpoint switched off?
An earlier implementation returned invented findings drawn from a hardcoded list, against a repository it never fetched. That is indefensible for a security vendor, so the endpoint was disabled on 22 September 2026 and stays disabled until a real scanner exists.
What are you planning to build?
Detection of credentials committed to a Git repository including history, a commit-time hook that prevents the leak, and rotation guidance for an exposed credential. Scope is still open and a pilot customer can influence it.
Do you store our source code?
There is nothing to store, because nothing is scanned. If and when a scanner exists, how a repository is accessed, what is retained and where it is processed will be agreed in writing before anything is connected.
When will it be available?
We are not giving a date we cannot hold. Talk to us and we will tell you exactly where it is.
Explore more products
Bachao.AI covers your entire security surface — from code to cloud to compliance.
Want this built?
The engine is off and there is nothing to demo yet. If secret scanning is a real need for you, talk to us — a pilot conversation is what decides what we build first.