Skip to main content
Security Audit is a beta feature. Detection coverage and UI are evolving — feedback is welcome.
The Credentials tab on the Security Audit page aggregates every credential or secret exposure Claw Lens has detected, grouped by credential type. Instead of hunting through individual events, you get a single table that tells you which secret types have been seen, how many are still active, and whether any appear to have been sent to an external service.
Audit Credential 1

​
Inventory columns

​
Status values

Each row in the credential inventory shows one of three statuses: Needs Rotation — There are active (non-dismissed) exposures of this credential type. The secret appeared in agent output but has not been confirmed as sent to an external service. Rotate the credential as a precaution and then dismiss the findings. All Dismissed — All exposures of this type have been reviewed and dismissed.
Exfiltrated — The credential appeared in agent output and the agent made an external network call later in the same session. The secret may have been sent to an external service. Rotate the credential immediately, then investigate which external URLs the agent contacted. Do not rely on dismissal alone.

​
Detected credential patterns

Claw Lens scans all tool outputs against the following patterns. Any match creates a finding and contributes to the credential inventory.

​
API keys and tokens

​
Tokens and secrets

​
PII

​
Blockchain

​
Dismissing findings

To mark a finding as reviewed, click Dismiss in the event detail panel on the Timeline tab, or use the dismiss action on an individual finding. Once dismissed:
  • The finding moves from Active to Dismissed in the inventory
  • The agent’s verdict may update if that was the last active finding of a given severity
  • The finding remains in the audit log — it is not deleted
When to dismiss: after you’ve confirmed the exposure was expected, was in a test context, or has already been remediated. When to rotate instead: if the status shows Needs Rotation or Exfiltrated, rotate the credential before dismissing. Dismissal is a record-keeping action, not a security control.
If the same credential type keeps appearing across sessions, check whether the agent has access to a file or environment variable it shouldn’t. Repeated exposure of the same secret type often points to a configuration issue rather than a one-off leak.