Secret and PII Scanning

Secret and PII Scanning

Secret and PII Scanning helps you identify exposed secrets and personally identifiable information (PII) across your development environment.

OX scans for sensitive information such as credentials, tokens, and PII that is stored directly in code or Git history, as well as secrets and PII that may be exposed through application logging.

OX provides native Secret and PII scanning and can also ingest findings from external Secret/PII scanning tools.

You can customize how OX detects secrets and PII to match your organization's environment and security requirements. For example, you can exclude known development credentials, detect proprietary token formats, and validate whether supported detected secrets are active.

What OX helps you identify

Secret and PII Scanning identifies sensitive information based on its type and where it is exposed.

Finding type	Description
PII in code	Identifies personally identifiable information exposed directly in source code.
PII in Git history	Identifies personally identifiable information that exists in the repository's Git history.
PII logging in code	Identifies code that may expose personally identifiable information through application logging.
Secret in code	Identifies secrets, such as credentials, API keys, passwords, and tokens, exposed directly in source code.
Secret in Git history	Identifies secrets that exist in the repository's Git history.
Secret logging in code	Identifies code that may expose secrets through application logging.

Secret and PII policies

Secret and PII policies determine how Secret and PII issues are identified and evaluated in OX. Policies cover secrets and PII exposed in source code, Git history, and application logging.

For information about the available policies and their configuration, see Secret and PII policies.

How it works

1. OX scans supported source code and Git history for secrets and PII.

2. OX identifies sensitive information exposed directly in code or Git history and code that may expose secrets or PII through logging.

3. When Secret Validation is enabled, OX attempts to determine whether supported detected secrets are active.

4. Configured exclusion patterns prevent known or intentionally used values from being reported.

5. Custom Secret/PII patterns extend OX detection to proprietary secrets, internal credentials, or organization-specific PII formats.

6. Findings are available in OX for investigation and remediation.

Configuring secret and PII detection

1. Go to Settings > Scan settings > Secrets.

1. Enable the required option.

Option	What it does
Secret Validation	Checks whether supported detected secrets are active
Exclude Secret/PII Patterns	Prevents matching patterns from being reported as findings
Custom Secret/PII Pattern Detection	Allows OX to detect organization-specific secret or PII patterns

1. Configure the required exclusion or custom detection patterns in the relevant section.

Changes are applied automatically after they are updated.

Secret and PII Scanning integrations

Secret/PII Scan connectors connect OX to tools that detect exposed secrets (API keys, tokens, passwords) and personally identifiable information (PII) in source code, configuration files, and repositories

• Fortify on Demand

• Fortify Software Security Center

• GitGuardian

• GitHub Secret Detection

• GitLab Secret Detection

• HCL AppScan

• OX Secret/PII Scan

• Semgrep Enterprise

• Wiz CLI Secrets: OX supports multiple Wiz connectors. For setup instructions, see the article Wiz in the Cloud Context folder.