GitLab Secret Scanning for Source Code (Beta)

GitLab Secret Scanning for Source Code is now in beta, powered by a new GitLab-built scan engine. Unlike the default analyzer, which detects only known secret patterns, this analyzer also detects passwords and other unstructured secrets that fall outside standard ruleset coverage. It also uses multiple heuristic techniques to reduce false positives. The new analyzer replaces the default analyzer in the same secret_detection job, matching existing vulnerability findings instead of creating duplicates.

To get started, see turn on the analyzer. During beta, only high-confidence findings are reported.

We welcome any feedback you have in issue 609578.