Design a Secrets Detection System
Last updated: December 9, 2025
Quick Overview
Design a system that scans code repositories, cloud configurations, container images, and runtime environments for exposed secrets like API keys, passwords, and certificates across thousands of tenants.
Wiz
December 9, 202513
12
1,608 solved
Design a system that scans code repositories, cloud configurations, container images, and runtime environments for exposed secrets like API keys, passwords, and certificates across thousands of tenants.
Exposed secrets are one of the most common and dangerous security issues in cloud environments. Wiz needs to detect secrets in diverse data sources (git repos, environment variables, config files, container layers) with high precision to avoid alert fatigue from false positives. The system must handle sensitive data with extreme care.
What the Interviewer Expects
- Design scan pipelines for different data sources (repos, configs, container images)
- Build a detection engine using pattern matching, entropy analysis, and verification
- Minimize false positives through multi-signal validation
- Handle the security of the detection system itself (it processes secrets)
- Address scale and performance for continuous scanning
Key Topics to Cover
How to Approach This
- Start by clarifying functional and non-functional requirements with the interviewer.
- Estimate the scale: QPS, storage, bandwidth. This drives your design decisions.
- Draw a high-level architecture first, then deep dive into 1-2 critical components.
- Discuss trade-offs explicitly (e.g., consistency vs availability, SQL vs NoSQL).
- Address failure scenarios, monitoring, and how the system handles 10x traffic spikes.
Possible Follow-up Questions
- How do you verify whether a detected secret is actually valid and active?
- How do you handle secrets that span multiple lines or are obfuscated?
- What is your strategy for reducing false positives below 5%?
Sharpen Your Skills on Codemia
Practice similar problems with our interactive workspace, get AI feedback, and track your progress.
Practice System Design ProblemsSample Answer
Detection Architecture
Multi-stage detection pipeline: Stage 1 uses high-recall pattern matching (regex for known secret formats like AWS keys, GitHub tokens, private key he...
False Positive Reduction
Multi-signal scoring: a detected string gets a confidence score based on format match strength, entropy level, context (e.g., variable name is 'passwo...
Submit Your Answer
