Credential scanning is automated probing for exposed secrets, such as passwords, access tokens, API keys, or other authentication data. Scanners may inspect public pages, client-delivered code, repositories, or exposed service endpoints where secrets were accidentally made accessible.
Attackers can use discovered credentials to attempt unauthorized access, while defenders use scanning to find and remove exposures before they are abused. Suspicious scanning traffic may claim to come from a trusted bot, but labels such as a user-agent string can be forged. Assess requests using behavior, volume, and the endpoints targeted; scanning alone does not prove that a secret was found, accessed, or misused.