Skip to main content
The Binarly Transparency Platform detects hardcoded secrets — credentials, tokens, keys, and other sensitive material — across all content within an analyzed image. Detection is architecture-independent: the engine normalizes everything it can extract from an image and scans it for secrets, regardless of the processor architecture the binary targets. Supported inputs include Docker container images, POSIX-based firmware (router firmware, BMC firmware), disk images, and archives. Any format the platform can unpack is eligible for secrets detection.

​
What is analyzed

The engine classifies extracted content into component types and applies the appropriate scanning strategy to each. POSIX binaries (ELF executables and shared libraries) are scanned as raw data. The engine does not disassemble or decompile them for secrets detection — it extracts readable strings and applies pattern matching against binary content. Secrets compiled into a binary or embedded as string literals are detected through this method. Some secret types have limited or no coverage in POSIX binaries: secrets that are encoded, split across memory, or reconstructed at runtime are not detected.

​
Detection method

The detection engine uses 200+ regex-based rules that match on the structure and format of known secret types: API key prefixes, JWT header patterns, webhook URL formats, URL credentials, and similar signatures. Entropy is calculated for each candidate match and reported alongside the finding. Shadow password file entries are parsed and each hashed password is checked against a list of 1,000+ common passwords. Supported hash formats: md5crypt, sha256crypt, and sha512crypt.

​
What is detected

​
Validation

Each secret finding carries a validity status populated by a dedicated validation service that calls out to external APIs to confirm whether the credential is still active. All secrets are reported regardless of validity status. Undetermined does not mean a credential is inactive: it means the check could not be completed. Validation runs automatically on SaaS. On on-prem deployments, it is disabled by default.

​
Finding details

Each secrets finding includes:
  • Location — the file path and component within the analyzed image where the secret was found
  • Secret value — the extracted string, shown as decoded text
  • Entropy — the entropy of the identified secret value
  • Validity — the validation status: Valid, Invalid, or Undetermined
  • CWE classification — the associated weakness class (hardcoded secrets are classified under CWE-798)