Three signals. One confidence score.
Every match is scored 0–100 from three independent signals, so confidence means something — and false positives don't bury the queue.
200+ compiled patterns
Cloud (AWS 35+, Azure 25+, GCP), VCS, payments, databases (35+), cryptographic material (20+), and generic token families (40+) — compiled once and cached.
Shannon entropy analysis
Multi-charset entropy — including decoded base64 and hex bytes — catches unknown and obfuscated secrets that no named pattern covers.
Contextual scoring
Surrounding keywords, variable names, and file types raise or lower confidence — a token in config.py is not a token in test fixtures.
From 10,000 matches to the 12 that matter.
Discovered credentials are checked read-only against provider APIs. A correlation engine assembles multi-component secrets — an AWS key ID paired with its secret — before validation. Results are stored with evidence and drive the decision engine.
GitHub
GET /userAWS
STS GetCallerIdentityStripe
read-only charges listAzure
AD token endpointA 21-state lifecycle, enforced by a transition table.
Findings are stateful work items, not console output. A deterministic, zero-LLM decision engine routes each validated finding; critical actions wait in a human approval queue; failures land in a dead-letter queue with retry limits.
Shallow when you're fast. Deep when you're thorough.
Repository caching makes subsequent scans ~80% faster; cross-scan deduplication by secret fingerprint keeps counts honest. Scheduled/incremental scans: In Development
Findings meet your existing workflow.
Slack
Block Kit alerts for critical findings, straight to the channel that owns them.
Email & Jira
SMTP/STARTTLS email and Jira tickets, created from the escalation registry.
SARIF 2.1.0
Uploads directly into GitHub Code Scanning — findings appear as code-scanning alerts.
GRC sync
A governance worker pushes confirmed findings into SimpleRisk or CISO Assistant, idempotently.
Block secrets before they're ever committed.
The Perryscope CLI installs a pre-commit hook that scans staged changes with the same detection engine as the server. Block or warn mode, with a configurable confidence threshold via .periscope.yaml.
The findings database is itself a secret store. It's treated like one.
Encrypted at rest
AES-256-GCM / Fernet under your keys, with MultiFernet rotation. Plaintext never appears in list APIs — display is masked by default.
Audited reveal
Revealing a secret requires a written justification, is rate-limited with a sliding window, and lands in an immutable audit log: who, when, why.
Hardened by default
Constant-time API-key comparison, security headers, CORS hardening, rate limiting, and fail-safe defaults — unknown storage mode falls back to encrypted.
Run your first org-wide scan today.
One Docker Compose command. Your infrastructure. Your keys.
Part of the Perryscope platform — see also Privacy Security and AI Guardienne, or explore the architecture.