Secret Scanners — Detecting Credentials in LLM I/O

Why it matters

Secret leaks common. Understanding shapes protection.

The architecture

Regex + entropy checks: high-entropy strings often secrets.

Known formats: AWS AKIA*, GitHub ghp_*.

How it works end to end

Tools: TruffleHog, gitleaks (originally for repos).

Custom rules per your credential formats.

Response: block + alert + rotate leaked secret.