Understanding Scan Results

A LEAKY report can contain several findings, and each one carries more than just "a secret was found here." This page explains the extra signals SecretsBuster attaches to every finding, and how to use them to decide what to act on first.

Leaky documents

A LEAKY report lists every document (URL) where something was found — this may not be the target URL itself; it's often a JavaScript bundle, third-party script, or API response the target loads. For each document, you get every detected secret's type, value, and how many times it occurred in that document.

Start here: identify which resource is exposing the secret and who owns it (your own code, a third-party script, a CDN-hosted bundle, etc.) — that determines who needs to act.

Live validation

For secret types SecretsBuster has a validator for, each detected secret is automatically tested against its provider's real API right after the scan completes, so you don't have to check by hand whether it's still active. Validation runs asynchronously and never slows down the scan itself — results appear in the report as soon as they're ready. There are four possible outcomes, shown as a badge on the finding:

Result	Meaning
Valid	The provider accepted the credential with active privileges. Highest urgency — it's live and exploitable right now.
Invalid	The provider rejected it. It may have been rotated or expired, or never been a real credential. Lower urgency, but worth a look if rotation was recent.
Validation error	Something went wrong while checking (network issue, rate limiting, unexpected response). Treat it as possibly still active and verify manually.
No validator	SecretsBuster doesn't have an automated validator for this secret type yet. The detection itself still stands.

Prioritize Valid findings first — rotate those credentials immediately, then work through the rest.

Confidence scoring

Every detected secret — validated or not — also gets a true positive confidence score from 0–100%, estimating how likely the value is a genuine credential rather than a placeholder, documentation example, or test fixture (like <YOUR_API_KEY_HERE> or a provider's own published example key). The score is shown as one of three labels:

Label	Score range	Meaning
High confidence	≥ 50%	Strongly resembles a real credential.
Medium confidence	25–49%	Ambiguous — worth a closer look.
Low confidence	< 25%	Likely a placeholder or example value.

If a secret passes live validation, its confidence is shown as 100% — a successful validation is ground truth and overrides the heuristic score.

Use this to cut through noise: a High confidence finding paired with a Valid validation result is the clearest signal something needs immediate action. A Low confidence, Invalid finding is usually safe to dismiss (or triage as a false positive) without much investigation.

Duplicates

If the exact same secret value turns up in more than one report, the finding shows a duplicates indicator listing the other affected targets. A credential that's hard-coded and consistently exposed across multiple scans or targets is a different, usually more urgent, problem than a one-off exposure — it likely means the value lives in shared code or configuration rather than a single mistake.

What to do with a finding

1. Identify the exposing resource and its owner — your own deployment, a third-party script, or a vendor's bundle.
2. Assess it — is it Valid/high confidence (act now), Invalid/low confidence (likely noise), or somewhere in between (investigate manually)? If you believe SecretsBuster got it wrong (false positive) or you're unsure what it means, contact us — feedback helps improve detection accuracy.
3. If it's real, open an internal incident: evaluate what access the credential grants, revoke/rotate it as soon as possible, investigate the root cause (common sources are CI/CD pipeline leaks, JavaScript bundling mistakes, or deployment misconfiguration), and check whether it was exploited before you caught it.
4. Review the report in the dashboard (or via the API) to record your triage decision — True positive, False positive, or Duplicate — so it's tracked and drops off your open Reviews list.