Vaulted Secrets Now Classified by Value

  Release Date: September 4, 2026

ggscout now runs the Secrets Detection Engine on every value it collects, so vaulted secrets are now classified against the same 550+ detectors used for code scanning, including multi-match detectors, so the NHI inventory can tell a real credential from a hostname, a feature flag, or a placeholder.

What does this mean for you?

• Classification through secret value: Know the nature of secrets collected in your vaults, CI, or K8S clusters rather than guessing through their name and path.
• The same detector filters as incidents: The inventory now filters and sorts by detector, detector type, secret family, secret category, and secret provider.
• Multi-match credentials stay together: Sibling fields that form one credential, such as a PostgreSQL username, password, host, and port, are classified as a single inventory entry, not four.
• Unknown secrets stay in the inventory. If no detector matches, the secret is still collected and labeled Unknown so you can easily exclude them without entirely dropping them.

Why is this important?

Classification from the secret value shows the exact composition of your vaults, CI systems, and clusters: real credentials on one side, potential noise on the other. Generic keys can hide a token, and "secret-ish" names can sometimes look like a secret but aren't. Detector, family, category, and provider let you filter that mix and focus the inventory on what matters.

The engine runs where the credential lives, inside your network, and attaches a detector before the hash is computed. That classified inventory is also the base for what comes next: validity checkers and secret permission analyzers will follow shortly.

Get started now

1. Upgrade ggscout to 0.32.0 or later. Use the binary, Python package, Docker image, or Helm chart.
2. Let ggscout fetch your sources. Existing inventory is classified on that run.
3. Open NHI Governance → Identities. Use the Detector column and filter by detector, detector type, secret family, category, or provider.

Learn how ggscout classifies secrets and how to use the inventory filters.

Enhancements

• Jira Tracking Integrations: Linked Jira tickets now get comments for more incident events: reassignment, regression, validity, access grants and revocations, public sharing, and feedback.
• Teams Management: When promoting a user to Member, you can set per-team incident permissions, apply one permission in bulk, and edit team rights afterward.
• Source Integrations: The unhealthy integration banner and its fix action now show only to managers and owners.

Fixes

• GitLab Integration: Fixed a bug occurring while uninstalling a GitLab integration.