Security scanning

What is secrets validation?

Checking whether a detected secret is actually live, usually by calling the provider, instead of just reporting that it looks like a key.

By Cláudia FernandesUpdated 2026-10-02

A repository can hold hundreds of strings shaped like credentials, such as expired keys, test fixtures, rotated tokens and documentation examples. Validation queries the issuing provider to sort the genuinely active ones from the noise.

This is the difference between a list of 400 possible secrets and a list of 6 that need rotating this afternoon. It is a comparatively rare capability, and worth checking which providers a tool can actually verify against.

What to look for

Which providers can be verified, since coverage is usually partial
Whether validation happens automatically or on demand
How the tool avoids leaking the secret further while checking it
Whether inactive findings are suppressed or just deprioritized

Best 6 code quality, security and code review tools with secrets validation

Every tool in the directory whose documentation covers this, 3 fully and 3 partially. Full support is shown first. Shown in a random order that changes on every visit, so no tool gets an advantage from its position.

Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

PR Review Tool

CodeRabbit

Verifies detected credentials against service providers by default; requires Security trial or add-on

Code Security Platform

GitHub Advanced Security

Validity checks confirm whether a detected secret is still active; also a credential revocation API

Code Security Platform

Semgrep

Local live API validation classifies valid/invalid across 630+ credential types; part of paid Secrets product.

Code Security Platform

Aikido

Contextual flagging separates actively used secrets from test values; no provider verification claimed

Code Security Platform

Checkmarx One

Live Secrets Validation automatically determines if discovered secrets are still valid and exploitable; uses high-entropy analysis, contextual flagging, and structural pattern recognition. No provider-level verification; customers must rotate via issuing services.

Code Quality Platform