> For the complete documentation index, see [llms.txt](https://docs.ox.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ox.security/ox-code/ox-scan-engines/managing-secret-and-pii-detection.md).
# Secret and PII Scanning
## Secret and PII Scanning
Secret and PII Scanning helps you identify exposed secrets and personally identifiable information (PII) across your development environment.
OX scans for sensitive information such as credentials, tokens, and PII that is stored directly in code or Git history, as well as secrets and PII that may be exposed through application logging.
OX provides native Secret and PII scanning and can also ingest findings from external Secret/PII scanning tools.
You can customize how OX detects secrets and PII to match your organization's environment and security requirements. For example, you can exclude known development credentials, detect proprietary token formats, and validate whether supported detected secrets are active.
### What OX helps you identify
Secret and PII Scanning identifies sensitive information based on its type and where it is exposed.
| Finding type | Description |
| ---------------------- | ---------------------------------------------------------------------------------------------------------- |
| PII in code | Identifies personally identifiable information exposed directly in source code. |
| PII in Git history | Identifies personally identifiable information that exists in the repository's Git history. |
| PII logging in code | Identifies code that may expose personally identifiable information through application logging. |
| Secret in code | Identifies secrets, such as credentials, API keys, passwords, and tokens, exposed directly in source code. |
| Secret in Git history | Identifies secrets that exist in the repository's Git history. |
| Secret logging in code | Identifies code that may expose secrets through application logging. |
### Secret and PII policies
Secret and PII policies determine how Secret and PII issues are identified and evaluated in OX. Policies cover secrets and PII exposed in source code, Git history, and application logging.
For information about the available policies and their configuration, see [Secret and PII policies](#secret-and-pii-policies).
### How it works
1. OX scans supported source code and Git history for secrets and PII.
2. OX identifies sensitive information exposed directly in code or Git history and code that may expose secrets or PII through logging.
3. When Secret Validation is enabled, OX attempts to determine whether supported detected secrets are active.
4. Configured exclusion patterns prevent known or intentionally used values from being reported.
5. Custom Secret/PII patterns extend OX detection to proprietary secrets, internal credentials, or organization-specific PII formats.
6. Findings are available in OX for investigation and remediation.
## Configuring secret and PII detection
1. Go to **Settings** > **Scan settings** > **Secrets**.
2. Enable the required option.
| Option | What it does |
| ----------------------------------- | ---------------------------------------------------------------- |
| Secret Validation | Checks whether supported detected secrets are active |
| Exclude Secret/PII Patterns | Prevents matching patterns from being reported as findings |
| Custom Secret/PII Pattern Detection | Allows OX to detect organization-specific secret or PII patterns |
3. Configure the required exclusion or custom detection patterns in the relevant section.
Changes are applied automatically after they are updated.
## Secret and PII Scanning integrations
Secret/PII Scan connectors connect OX to tools that detect exposed secrets (API keys, tokens, passwords) and personally identifiable information (PII) in source code, configuration files, and repositories
### Secret/PII Scan supported integrations
* Fortify on Demand
* Fortify Software Security Center
* GitGuardian
* GitHub Secret Detection
* GitLab Secret Detection
* HCL AppScan
* OX Secret/PII Scan
* Semgrep Enterprise
* Wiz CLI Secrets: OX supports multiple Wiz connectors. For setup instructions, see the article [Wiz ](/ox-integrations/3rd-party-integrations/cloud-context/wiz.md)in the Cloud Context folder.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.ox.security/ox-code/ox-scan-engines/managing-secret-and-pii-detection.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
