Finding a vulnerability is half the job. The other half is fixing it before an attacker does. Veritas RedTeam automates both: it discovers exposed secrets and vulnerabilities, then generates reviewable patches as pull requests so your team merges the fix, not the finding.
Secret scanning: what is exposed
Leaked credentials are the fastest path to a Web3 exploit. RedTeam's Credential Hunt agent sweeps your repositories, paste archives, and public datasets for exposed keys:
- Private keys and mnemonics in source files, test fixtures, and commit history.
- API keys for oracle services, RPC providers, and exchange endpoints.
- AWS, GCP, and cloud provider credentials in config files and environment variables.
- Webhook secrets and JWT signing keys in frontend bundles.
- Database connection strings in committed YAML, TOML, and JSON configs.
Exposed API key scanner: validating liveness
Finding a key is not enough. RedTeam validates whether the key is live, meaning whether it still grants access to the target service. This prevents false urgency over rotated keys and confirms real exposure:
- API keys are tested against their target service with a safe, read-only probe.
- Cloud credentials are checked for IAM permissions scope (not just existence).
- Private keys are checked against known compromised-address databases.
- Live keys are flagged as critical; rotated or expired keys are noted as informational.
A leaked key that is still live is a critical finding. A leaked key that was rotated last week is a process problem, not an active exploit. RedTeam distinguishes between the two.
GitHub secrets scanning: across repos and history
Secrets leak into git history and stay there even after they are removed from the working tree. RedTeam scans:
- Current branch: all files in the working tree.
- Commit history: every commit in the repository, including deleted files and force-pushes.
- Pull request branches: code submitted but not yet merged, before it reaches main.
- CI/CD config: GitHub Actions workflows, Dockerfiles, and deployment scripts.
AI security remediation: from finding to pull request
Once a vulnerability or exposed secret is confirmed, CypherFix generates a remediation patch. The patch is opened as a pull request with:
- A unified diff showing the exact lines changed.
- A rationale block explaining what was vulnerable and why the patch fixes it.
- Test cases that reproduce the vulnerability and pass after the patch.
- For secret exposure: rotation guidance and the steps to invalidate the leaked credential.
The pull request is the unit of remediation. Your engineer reviews it, adjusts if needed, and merges. The AI does not push to main; it creates a reviewable change.
Security findings to pull requests: the workflow
The full remediation pipeline, from detection to merged fix:
- RedTeam detects the vulnerability or exposed secret during a continuous scan.
- The finding is verified with a proof-of-concept or a liveness check.
- CypherFix generates a patch with tests and rationale.
- A pull request is opened against the target branch.
- A human engineer reviews, adjusts, and merges the pull request.
- RedTeam re-scans after the merge and confirms the finding is resolved.
This is automated vulnerability remediation, not automated merging. The human review step is the last gate. The AI gets you to the gate faster; the engineer decides whether to open it.
Get started
To run secret scanning and automated remediation against your repositories:
- Connect your repositories to RedTeam.
- Define which secrets and vulnerability classes to scan for.
- Choose whether patches are opened as pull requests or queued for batch review.
Reserve a scoped scan or join the waitlist to get started.
Learn more about Veritas Protocol or explore the CypherFix auto-remediation feature.