|
| 1 | +--- |
| 2 | +title: Secret Validation |
| 3 | +aliases: /security/code_security/secret_scanning/secret_validation/ |
| 4 | +is_beta: true |
| 5 | +algolia: |
| 6 | + tags: ['static analysis', 'ci pipeline', 'SAST', 'secret scanning'] |
| 7 | +--- |
| 8 | +## About validity checks |
| 9 | +For certain detections (see the list below), Datadog checks whether a detected secret is valid during scans. For these live validation checks, Datadog makes API requests to provider endpoints to confirm that a credential is active. Datadog only makes requests to endpoints that do not return sensitive data or personally identifiable information (PII), and only to verify if the credential can still access the provider endpoint. |
| 10 | + |
| 11 | +For secret types with validation available, Datadog displays the validation status in the explorer as "Active" or "Inactive". You can also filter or query detections by their Validation Status. |
| 12 | + |
| 13 | +For some secret types, Datadog uses static validation methods, such as computing a checksum, to confirm that a detected secret is not a false positive. Static validation results are not displayed and all references to "validation" in the explorer correspond to live validation results. |
| 14 | + |
| 15 | +## List of supported validators |
| 16 | +| Secret type | Static validator available | Live validator available | |
| 17 | +|-------------|----------------------------|--------------------------| |
| 18 | +|`adobe_access_token`|✓|✓| |
| 19 | +|`adobe_refresh_token`|✓|✗| |
| 20 | +|`adafruit_io_key`|✗|✓| |
| 21 | +|`aiven_personal_token`|✗|✓| |
| 22 | +|`anthropic's_claude_api_key`|✗|✓| |
| 23 | +|`asana_oauth_token`|✓|✓| |
| 24 | +|`asana_personal_access_token`|✗|✓| |
| 25 | +|`atlassian_access_token`|✓|✓| |
| 26 | +|`atlassian_refresh_token`|✓|✗| |
| 27 | +|`aws_access_key_id`|✗|✓| |
| 28 | +|`aws_secret_access_key`|✗|✓| |
| 29 | +|`azure_container_registry_key`|✓|✗| |
| 30 | +|`azure_entra_id_token`|✓|✗| |
| 31 | +|`beamer_api_token`|✗|✓| |
| 32 | +|`bitbucket_oauth_access_token`|✗|✓| |
| 33 | +|`buildkite_access_token`|✗|✓| |
| 34 | +|`circleci_personal_access_token`|✗|✓| |
| 35 | +|`circleci_project_access_token`|✗|✓| |
| 36 | +|`cloudflare_api_token`|✗|✓| |
| 37 | +|`cloudflare_origin_ca_key`|✗|✓| |
| 38 | +|`contentful_access_token`|✗|✓| |
| 39 | +|`datadog_api_key`|✗|✓| |
| 40 | +|`datadog_nonce_session_token`|✗|✓| |
| 41 | +|`datadog_personal_access_token`|✗|✓| |
| 42 | +|`discord_application_oauth_access_token`|✗|✓| |
| 43 | +|`discord_application_token`|✗|✓| |
| 44 | +|`discord_bot_token`|✗|✓| |
| 45 | +|`docker_access_token`|✓|✓| |
| 46 | +|`doppler_access_token`|✗|✓| |
| 47 | +|`dropbox_access_token`|✗|✓| |
| 48 | +|`duffel_test_access_token`|✗|✓| |
| 49 | +|`fastly_api_token`|✗|✓| |
| 50 | +|`flutterwave_api_secret_key`|✗|✓| |
| 51 | +|`frame_io_developer_token`|✗|✓| |
| 52 | +|`frame_io_oauth_session_secret`|✗|✓| |
| 53 | +|`github_access_token`|✓|✓| |
| 54 | +|`github_fine-grained_personal_access_token`|✗|✓| |
| 55 | +|`heroku_api_key`|✗|✓| |
| 56 | +|`hugging_face_access_token`|✗|✓| |
| 57 | +|`intercom_access_token`|✗|✓| |
| 58 | +|`launchdarkly_access_token`|✗|✓| |
| 59 | +|`lichess_personal_access_token`|✗|✓| |
| 60 | +|`non_expired_json_web_token`|✓|✗| |
| 61 | +|`notion_integration_token`|✗|✓| |
| 62 | +|`npm_access_token`|✓|✓| |
| 63 | +|`openai_project_api_key`|✗|✓| |
| 64 | +|`openai_user_api_key`|✗|✓| |
| 65 | +|`oracle_access_token`|✓|✗| |
| 66 | +|`pagerduty_api_token`|✗|✓| |
| 67 | +|`perfect_cloud_api_key`|✗|✓| |
| 68 | +|`postman_api_key`|✗|✓| |
| 69 | +|`pulumi_access_token`|✗|✓| |
| 70 | +|`rubygems_api_key`|✗|✓| |
| 71 | +|`sendgrid_api_key`|✗|✓| |
| 72 | +|`sentry_organization_token`|✗|✓| |
| 73 | +|`sentry_personal_token`|✗|✓| |
| 74 | +|`shippo_api_key`|✗|✓| |
| 75 | +|`shippo_jwt`|✓|✓| |
| 76 | +|`slack_access_token`|✗|✓| |
| 77 | +|`snowflake_personal_access_token`|✓|✗| |
| 78 | +|`square_access_token`|✗|✓| |
| 79 | +|`typeform_personal_access_token`|✗|✓| |
| 80 | +|`twilio_access_token`|✓|✗| |
| 81 | +|`workos_api_key`|✗|✓| |
| 82 | +|`xai_(grok)_api_key`|✗|✓| |
0 commit comments