Pingtower
Docs
Secret detection
Every line is checked for things shaped like credentials. A match opens a warning, never rewrites the line on a guess, and the finding never holds the secret. Block an exact value and it is redacted everywhere Pingtower kept it.
Pingtower cannot know what your secrets look like, so it never blanks text on a guess. Ingest checks each line against a list of credential shapes. A match stores the line exactly as sent, flags it, and raises a finding that tells the team to take the secret out of the code that logs it. The one thing that ever replaces text is someone blocking that exact value.
In the web app, findings are under Sources → Secrets, and the sources list shows a badge on each source with open findings.
What is detected
Each line’s message and every key value are checked for these shapes. A key whose name says it holds a secret counts too, whatever its value.
| Pattern | Matches |
|---|---|
basic authorization | An Authorization: Basic … value. |
bearer token | Bearer followed by a token, in a header, a curl line or a stack trace. |
url credentials | A user name and password in a URL: https://user:pass@host. |
jwt | A JSON Web Token. |
aws access key | An AWS access key id (AKIA…, ASIA… and the other IAM prefixes). |
pingtower token | Pingtower’s own keys and tokens, heartbeat tokens included. |
secret key-value | key=value or "key": "value" where the key names a secret: password, passwd, pwd, secret, client_secret, token, access_token, refresh_token, api_key, access_key, secret_key, private_key or authorization, with or without a prefix such as DB_PASSWORD or stripe_api_key. |
key named `…` | A key in keys with one of those names, or cookie or set-cookie. The finding names the key, never its value. |
This is a best-effort list. A secret in a shape not listed passes unnoticed. Detection runs whether or not the source keeps its lines.
Findings
A finding is one pattern seen from one source in one project. Repeats count against it rather than opening another, so a client that leaks on every line raises one finding. It records the pattern, the source, when it was first and last seen, and how many lines matched. It never holds the matched text. A project holds up to 200 findings; past that, a new pattern still flags its lines but raises no new finding.
Each kept line that matched carries secret_warning: true on the log tail and in search, so the web app can point at the newest one.
| State | Means |
|---|---|
open | Waiting for someone to act. |
dismissed | Marked safe. Stays quiet however often the pattern matches again. |
blocked | A block removed the value from every line that tripped it. A new match reopens it. |
The warning alert
A new finding opens an alert so someone hears about it. It is an ordinary alert at level 300 (warn), with kind secret_warning and rule name secret-warning, delivered through the project’s usual channels: push, integrations and webhooks. Its message names the source and the pattern, never the text. Its identifiers carry finding_id and pattern, which link it to the finding.
It has no rule behind it, so it never re-notifies and never escalates. It can be acked like any alert. It resolves when the finding is marked safe or its value is blocked. One finding holds at most one open warning; a finding that matches again after a block opens a new one, since that is a new leak of the same shape.
Marking a finding safe
For a false positive, or a value the team accepts, an owner or admin marks the finding safe. It becomes dismissed, its open warning resolves, and it stays quiet from then on. The lines stay as they were.
Blocking a value
Blocking takes the exact secret, as it appears in a flagged line, and replaces it with [redacted]:
- in every line the source or project sends from then on, before it is stored, templated or matched by rules;
- in every line already kept;
- in what Pingtower kept elsewhere from those lines: alert messages, templates and grouping values, the alert snapshots kept in incidents, and the stored copy of each delivery.
In a message or key value, the blocked value is replaced wherever it appears as a whole token, split on spaces and on = : , ; " ' & ? / { } [ ] ( ) < >. In a key name, a tag, or env, host, run or trace_id, the whole field becomes [redacted] if it contains the value anywhere. A key whose name is redacted keeps its value under [redacted], then [redacted]-2 and so on.
Pingtower keeps only a keyed hash of the value and its length, never the value itself. The plaintext is used to rewrite what is already stored and then dropped. A block applies to one source or to the whole project.
| Rule | Limit |
|---|---|
| Value | 8 to 512 bytes, one token: no spaces and none of the delimiters above. Shorter values are refused because their hash would be cheap to guess. |
| Blocks | 200 per project. |
| Duplicates | Blocking a value already blocked in the same scope is refused. |
The result reports how many kept lines and other stored rows were rewritten and how many findings were resolved. Open findings that no rewritten line still trips become blocked, and their warnings resolve.
Deleting a block stops redacting new lines. It does not restore anything already redacted.
Deleting the lines
An owner or admin can also delete the lines: one line, or a source’s lines over a time range. That removes the whole line rather than just the secret, and it does not resolve the finding or its warning. Mark the finding safe or block the value for that.
Who can do what
| Action | Needs |
|---|---|
| See findings and blocks | Viewer and up, or secrets:read. Blocks list their scope, length and who made them, never the value. |
| Mark safe, block, delete a block | Owner or admin, or a custom role with secrets:write. |
| Delete lines | Owner or admin, or a custom role with logs:write. |
Marking safe, blocking, deleting a block and deleting lines are each recorded in the audit log.
AI assistants
The MCP connector has its own, separate redaction: it scrubs these shapes from everything it returns to an assistant. That applies only to the assistant’s copy and does not depend on findings or blocks.