Secrets detection is the automated search for credentials, such as passwords, API keys, tokens and private keys, that have been written into source code, configuration files or commit history. Detection tools match known key formats and high-entropy strings, then flag or block the commit before the secret spreads.
In infrastructure code, secrets often appear as default passwords in Ansible variables, provider credentials in Terraform files, or tokens pasted into a Playbook during debugging. Once pushed, a secret stays in Git history even after the line is deleted, so it must be rotated.
To keep secrets out of infrastructure code, use Ansible Vault or an external secrets manager for Ansible, and environment variables or a secrets backend for Terraform. Then add secrets detection at commit and in CI/CD as a safety net.
Steampunk Spotter includes security checks for Ansible and Terraform code as part of its CI/CD gate, so flagged code can be blocked before it’s merged.
