New Savings Proposals: approve, test and roll back cost changesLearn more Sign in|Talk to a cloud engineer
Product tourGet a demo

Find the keys you already committed

CloudLens scans your repositories for keys and tokens — in the working tree, across the full git history, and in config and infrastructure files. Secrets that were deleted from the code but still live in history are the ones that get you.

Get a demoSee all code security
What you're watchinglive product
  1. 1
    Scan code and history, not just HEAD

    Gitleaks runs over the working tree and the full git history, so a key removed from the code but left in a commit still shows up.

  2. 2
    Read the masked evidence

    The finding shows the commit, the file and a masked preview (AKIA••••••••7Q). The live secret is never displayed or stored.

  3. 3
    Follow the fix

    Rotate the key, delete the old one, strip it from history with git filter-repo and force-push, then move secrets to a manager.

  4. 4
    File it with one click

    Create a Jira issue with the masked evidence, commit and fix steps attached, or post it to Slack or Teams.

Who does thisSecurity engineer, with the team that owns the repositoryWhat you getThe exact commit, file and fix for every exposed secret — without the secret ever leaving your cloud.
Working tree
+ history
scanned, so deleted-but-committed keys are found
Masked
always
live secret values are never shown or stored
4
0
detectors: Gitleaks, history, CloudLens rules, entropy
1 click
Jira
to a ticket with evidence and fix steps

A rotated key is not a removed key

The secret you deleted this morning is still readable by anyone who can clone the repo.

History

Deleting a secret from code does not remove it

What usually happens: A key is taken out of .env and committed. It still sits in the previous commit, recoverable by anyone with read access.

How CloudLens resolves it: The full history is scanned, so the key is flagged with the exact commit that still contains it.

Resolved
Coverage

Secrets hide outside source files

What usually happens: Tokens end up in .env, CI values, Terraform variables and shell scripts that a code-only scanner skips.

How CloudLens resolves it: Config, IaC and script files are scanned alongside code, so a Slack webhook in values.yaml is caught too.

Resolved
Safety

The scanner should not become the leak

What usually happens: Some tools store or display the secret they found, turning the finding into a second copy to protect.

How CloudLens resolves it: Only a masked preview is shown. The live value is never displayed, logged or stored by CloudLens.

Resolved

Open the finding, read the evidence

Every finding is a commit, a file and a line, with a fix plan attached — not just a red count.

From the finding to a fix in one click

Static code analysis (SAST)
Open a finding and you see where the secret is, a masked preview, why it still matters, and the three-step fix. Rotate, remove from history, then move it to a secret manager.
  • Masked preview — never the live value
  • Commit, file and line for every hit
  • Rotate · scrub history · move to a manager
Secrets are only the start

See every risk in your repositories in one view

Explore code security

How a key from a test commit got rotated before lunch

A Tuesday at Lumora Retail: a secret scan flags a key that was removed months ago but never scrubbed from history.

DPDev PatelSecurity engineer, Lumora Retail

Lumora Retail is a fictional company. The people, names and numbers are sample data.

    1
    Tue 10:05Critical

    A Critical secret finding lands

    An AWS access key is flagged in checkout-api — not in the code, but in commit 4f2a91c from 41 days ago.
    2
    Tue 10:08

    Opens the masked evidence

    The finding shows the commit message, .env:2 and AKIA••••••••7Q. The live value is never shown.
    3
    Tue 10:15

    Rotates and scrubs

    The key is rotated and deleted in the cloud account, then removed from history with git filter-repo and force-pushed.
    4
    Tue 10:22SEC-91

    Files the trail

    A Jira issue SEC-91 is created with the masked evidence and fix steps, so the rotation is auditable.

The fastest security win in the repo

History, not just HEAD

The whole commit history is scanned, so secrets that were removed from the code but never scrubbed are still found.

Masked by design

Only a masked preview is shown. The finding never becomes a second place your secret lives.

Straight to a ticket

One click opens a Jira issue with the masked evidence, commit and fix steps, routed to the repo's owner.

Static Code Analysis SAST on your first-party code, in the pull request.
Software Composition Analysis Vulnerable and risky open-source dependencies.
Code Security Every risk in your repositories, in one view.

Secret scanning questions

No. CloudLens shows a masked preview only, such as AKIA••••••••7Q. The live value is never displayed, logged or stored, so a finding never becomes a second copy of the secret.

Both. Gitleaks runs over the working tree and the full git history, which is how keys that were removed from the code but left in an old commit are caught.

Cloud access keys, provider API keys and tokens (for example Stripe and GitHub), database passwords, webhook URLs and other high-entropy strings, using Gitleaks, CloudLens rules and entropy checks.

Yes. The same rules run as a pre-commit and pull-request check, so a secret is caught before it reaches the default branch.

Ready to see CloudLens in action?

Connect a read-only AWS role or Azure service principal. We'll walk you through your bill, your security graph and the first things worth fixing.