Introduction
One of the most common and dangerous security mistakes in software development is accidentally exposing secrets in source code repositories. API keys, database credentials, connection strings, access tokens, certificates, and cloud credentials frequently find their way into Git commits, pull requests, and configuration files.
According to multiple security reports, leaked secrets remain one of the leading causes of cloud breaches, unauthorized access, and data exposure incidents. As development teams adopt faster CI/CD pipelines and AI-assisted coding tools, the risk of accidentally committing sensitive information continues to increase.
Traditional secret scanning tools primarily rely on pattern matching and predefined rules. While effective for known secret formats, they often generate false positives and struggle to identify context-specific risks.
Artificial Intelligence introduces a more intelligent approach by understanding code context, identifying suspicious patterns, classifying risk levels, and even recommending remediation strategies automatically.
In this article, we'll build an AI-powered secret detection and remediation platform using ASP.NET Core, GitHub APIs, Azure OpenAI, and automated repository scanning techniques.
Understanding Repository Secrets
A secret is any sensitive piece of information that grants access to systems, applications, or resources.
Common examples include:
Azure Access Keys
AWS Credentials
Database Passwords
JWT Signing Keys
OAuth Tokens
API Keys
SSH Private Keys
Encryption Secrets
Consider the following example:
var connectionString =
"Server=db01;Database=Prod;
User=admin;
Password=SuperSecret123";
This code exposes credentials directly in source control and creates a serious security risk.
Why Traditional Secret Detection Falls Short
Most secret scanning tools use:
Regular expressions
Static rules
Known token patterns
Example:
AKIA****************
These approaches have limitations:
AI systems can analyze surrounding code and determine whether a value is genuinely sensitive.
How AI Improves Secret Detection
AI models can evaluate:
Variable names
Configuration files
Repository context
Code comments
Usage patterns
Security risk indicators
For example:
var productionApiKey =
"ABC123XYZ";
A traditional scanner may not recognize this value.
An AI model can infer from the variable name and surrounding code that the value is likely a credential.
Solution Architecture
An AI-based secret detection platform typically consists of four layers.
Repository Analysis Layer
Collect data from:
GitHub
Azure DevOps
Git Repositories
Secret Detection Layer
Analyze:
Source code
Configuration files
Infrastructure code
CI/CD pipelines
AI Classification Layer
Azure OpenAI evaluates findings and assigns risk levels.
Remediation Layer
Generate recommendations and automated fixes.
Creating the ASP.NET Core Project
Create a new Web API project.
dotnet new webapi -n SecretDetectionPlatform
Install required packages.
dotnet add package Azure.AI.OpenAI
dotnet add package Octokit
These packages provide repository access and AI integration.
Modeling Secret Findings
Create a model to represent detected secrets.
public class SecretFinding
{
public string FileName { get; set; }
public string SecretType { get; set; }
public string RiskLevel { get; set; }
public string LineNumber { get; set; }
}
This model stores detection results for further analysis.
Scanning Repository Files
Create a repository scanner.
public class RepositoryScanner
{
public IEnumerable<string> ScanFiles(
string repositoryPath)
{
return Directory.GetFiles(
repositoryPath,
"*.*",
SearchOption.AllDirectories);
}
}
The scanner gathers files for evaluation.
Common targets include:
appsettings.json
.env files
YAML pipelines
Infrastructure templates
Source code files
Implementing Rule-Based Detection
Before invoking AI, perform initial pattern matching.
Example:
public bool ContainsSecret(
string content)
{
return content.Contains(
"Password=",
StringComparison.OrdinalIgnoreCase);
}
This identifies obvious exposures quickly.
Typical patterns include:
Password=
ApiKey=
Secret=
Token=
ConnectionString=
Rule-based detection remains an important first layer.
Integrating GitHub Repository Analysis
GitHub APIs allow scanning of pull requests and commits.
Example service:
public class GitHubRepositoryService
{
private readonly GitHubClient _client;
public GitHubRepositoryService(
string token)
{
_client = new GitHubClient(
new ProductHeaderValue(
"SecretScanner"));
_client.Credentials =
new Credentials(token);
}
}
This enables continuous repository monitoring.
Building the AI Detection Engine
Create a service that analyzes suspicious content.
public class AISecretAnalysisService
{
private readonly OpenAIClient _client;
public AISecretAnalysisService(
OpenAIClient client)
{
_client = client;
}
public async Task<string> AnalyzeAsync(
string code)
{
var prompt = $"""
Analyze the following code.
Determine:
1. Whether a secret exists
2. Secret type
3. Risk level
4. Remediation recommendation
{code}
""";
var response =
await _client.GetChatCompletionsAsync(
"gpt-4o",
new ChatCompletionsOptions
{
Messages =
{
new ChatMessage(
ChatRole.User,
prompt)
}
});
return response.Value
.Choices[0]
.Message
.Content;
}
}
The AI model provides context-aware security analysis.
Example AI Analysis
Input:
string apiKey =
"sk-prod-123456789";
Generated output:
Secret Detected:
Yes
Type:
API Key
Risk Level:
High
Recommendation:
Move credential to Azure Key Vault
and rotate the exposed key immediately.
This delivers much more context than simple pattern matching.
Detecting Secrets in Configuration Files
Many leaks occur in configuration files.
Example:
{
"ConnectionStrings": {
"DefaultConnection":
"Server=prod-db;
User=admin;
Password=Secret123"
}
}
AI can classify this as:
Secret Type:
Database Credential
Risk:
Critical
This improves detection coverage significantly.
Automated Remediation Recommendations
AI can suggest secure alternatives.
Example recommendation:
Current Risk:
Hardcoded Password
Recommended Fix:
Store credential in Azure Key Vault.
Access it using Managed Identity.
This helps developers resolve issues faster.
Generating Secure Code Replacements
AI can also generate replacement code.
Example:
var secret =
configuration["ApiKey"];
or
var secret =
await secretClient
.GetSecretAsync("ApiKey");
These recommendations align with modern security practices.
Risk Classification
Not all secrets have the same severity.
Example categories:
Low
Medium
High
Critical
Factors include:
Credential type
Repository visibility
Production exposure
Access privileges
Example:
AWS Root Credentials
Risk:
Critical
AI can evaluate these factors automatically.
Integrating CI/CD Pipelines
Secret scanning should occur before code reaches production.
Example GitHub Action:
name: Secret Scan
on:
pull_request
jobs:
security:
runs-on: ubuntu-latest
steps:
- name: Run Secret Detection
run: dotnet run
This prevents accidental exposure during development.
Advanced Enterprise Features
Large organizations often extend detection systems with additional capabilities.
Historical Secret Tracking
Monitor:
Pull Request Analysis
Analyze:
New commits
Code changes
Configuration updates
before merges occur.
Compliance Reporting
Generate reports for:
SOC 2
PCI-DSS
ISO 27001
Internal audits
Multi-Repository Scanning
Evaluate:
from a centralized platform.
Best Practices
Never Store Secrets in Source Code
Use:
Azure Key Vault
AWS Secrets Manager
HashiCorp Vault
instead of hardcoded values.
Implement Multiple Detection Layers
Combine:
Rule-based scanning
AI analysis
CI/CD validation
for maximum effectiveness.
Rotate Exposed Credentials Immediately
Detection alone is not sufficient.
Compromised credentials should be replaced as quickly as possible.
Monitor Pull Requests
Prevent secret exposure before code is merged.
Continuously Improve Detection Rules
Threats evolve constantly.
Review scanning policies regularly.
Benefits of AI-Based Secret Detection
Organizations implementing intelligent secret detection often achieve:
Improved security posture
Reduced credential leaks
Faster remediation
Better compliance readiness
Lower operational risk
Stronger DevSecOps practices
Security teams gain visibility while developers receive actionable guidance.
Conclusion
Hardcoded secrets remain one of the most common security vulnerabilities in modern software development. As repositories grow larger and deployment cycles accelerate, traditional scanning approaches often struggle to provide sufficient context and remediation guidance.
By combining ASP.NET Core, GitHub repository analysis, Azure OpenAI, and automated security workflows, organizations can build intelligent secret detection platforms that identify risks earlier, reduce false positives, and recommend secure alternatives automatically. As AI-powered DevSecOps continues to evolve, intelligent secret management will become a foundational capability for secure software delivery.