Skip to main content

SecretsBuster Documentation

SecretsBuster is a service that scans websites for leaked secrets — API keys, credentials, tokens, and other sensitive information exposed in JavaScript, network traffic, and other public resources. It's built for developers, security teams, and vendors who want to catch exposed credentials before attackers find them.

This documentation covers how to use SecretsBuster as a customer: the dashboard, the API, the GitHub Action, and how to interpret and act on scan results.

Contents​

  • Concepts — the vocabulary used across the dashboard and API: targets, domains, reports, scan results, secrets, validation, confidence scoring, and review workflow.
  • Getting Started — sign up, get your API key, and run your first scan.
  • Using the Dashboard — manage domains and targets, read reports, and triage findings from the web dashboard.
  • Using the API — authenticate, create and poll scans, and integrate SecretsBuster into your own tools.
  • GitHub Action — scan on every push or pull request and fail the build on exposed secrets.
  • Understanding Scan Results — how to read a report: leaked secrets, live validation, confidence scores, and duplicate detection.
  • FAQ — common questions about plans, quotas, and billing.