Source code and CI/CD
Deploy keys, pipeline tokens and bot accounts: the credentials most often found in code. The checker reads the system column to group the accounts; the findings come from the other columns, the same way for every system.
What the export usually carries
A source code and CI/CD platform keeps three different kinds of credential: personal access tokens belonging to a person, deploy keys attached to one repository, and pipeline or workload identities the platform issues per run. Exports usually carry created, expires and last used per token or key, and the owner for personal tokens only; a deploy key names a repository, not a person, so its owner has to come from your own records.
What the checker most often raises here
- 8. Credential stored in code, a config file or a script: The stored-in column reads code, a config file, a script, or a document (a spreadsheet, a wiki, an email or a chat).
- 6. Password or key not changed within the period, or never: The last changed date is more than the period you set (default 365 days) before the as-at date, or the list says never. With PCI DSS ticked, a user account whose MFA does not read yes also fires at more than 90 days (8.3.9); with MFA not recorded that line is a question. For a system account under PCI DSS 8.6.3 the period is your targeted risk analysis, and the one you set stands in for it.
- 2. Owner has left, or owner not recognised: The account is not a personal account, its owner names a person, and the staff list is pasted: when the list says that person has left it is a gap; when the owner is not in the list at all it is a question ("owner not recognised, confirm"). Without a staff list this finding never fires.
- 14. A secret where a label belongs: A cell matches a recognised secret pattern: a cloud access key, a private key block, a password, secret or token pair written with an equals sign, or a long run of hexadecimal or mixed-case base64 characters. The cell is replaced before anything renders.
Account types found here
- Built-in or vendor default accounta system account
- Break-glass or emergency accounta user account
- AI agent credentiala system account
- Automation or bot (scheduled jobs, RPA)a system account
- Service accounta system account
- API key or access keya system account
- OAuth client or app registrationa system account
- Device or workload identitya system account
- Mailbox or resource accounta user account
- Test accounta user account
- Shared or generic logina user account
- Administrator or privileged person accounta user account
- Contractor or guesta user account
- Person (employee)a user account
The system names in your export are matched to these classes by the browser dictionary; product names are never shown on these pages. A system the dictionary does not place reads as other, and every finding still works.