---
title: "Secret scanning"
description: "Where Overlane scans for credentials, what blocks, what is only reported, and what the findings contain."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.overlane.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Secret scanning

Overlane scans every write to the API (pushes, task records, evidence and rule files), memory candidates and review diffs for credentials, on the server. You can also scan a log file yourself with `--source log`; automatic log scanning arrives with observability.

- A **provider-prefixed key** (GitHub, Stripe, AWS, Slack, Google, npm, private key blocks, JSON web tokens and Overlane tokens), and a vendor token such as an Anthropic or OpenAI key, **blocks**. Nothing is stored or pushed.
- A **generic high-entropy string** is **reported, not blocked**, as GitHub push protection does.

A finding names the rule, the source and the line. It never contains the matched text, so it is safe to log and to return.

```sh
overlane guard scan --path src/config.ts
overlane guard scan --path ci.log --source log
```

The command exits 6 when something would block. A blocked push comes back as a refusal with the code `secret_detected`; remove the key, rotate it, and push again.

In a review, a credential in the diff is replaced before anything is sent to a model and is raised as a critical finding.

Source: https://docs.overlane.app/review/secret-scanning/index.mdx