Design a Secrets Detection System
Last updated: December 9, 2025
Quick Overview
Design a system that scans code repositories, cloud configurations, container images, and runtime environments for exposed secrets like API keys, passwords, and certificates across thousands of tenants.
Wiz
December 9, 202513
12
1,608 solved
Design a system that scans code repositories, cloud configurations, container images, and runtime environments for exposed secrets like API keys, passwords, and certificates across thousands of tenants.
Exposed secrets are one of the most common and dangerous security issues in cloud environments. Wiz needs to detect secrets in diverse data sources (git repos, environment variables, config files, container layers) with high precision to avoid alert fatigue from false positives. The system must handle sensitive data with extreme care.
What the Interviewer Expects
- Design scan pipelines for different data sources (repos, configs, container images)
- Build a detection engine using pattern matching, entropy analysis, and verification
- Minimize false positives through multi-signal validation
- Handle the security of the detection system itself (it processes secrets)
- Address scale and performance for continuous scanning
Key Topics to Cover
How to Approach This
- Start by clarifying functional and non-functional requirements with the interviewer.
- Estimate the scale: QPS, storage, bandwidth. This drives your design decisions.
- Draw a high-level architecture first, then deep dive into 1-2 critical components.
- Discuss trade-offs explicitly (e.g., consistency vs availability, SQL vs NoSQL).
- Address failure scenarios, monitoring, and how the system handles 10x traffic spikes.
Possible Follow-up Questions
- How do you verify whether a detected secret is actually valid and active?
- How do you handle secrets that span multiple lines or are obfuscated?
- What is your strategy for reducing false positives below 5%?
Sharpen Your Skills on Codemia
Practice similar problems with our interactive workspace, get AI feedback, and track your progress.
Practice System Design ProblemsSample Answer
Requirements
- Functional Requirements:
- Scan code repositories (GitHub, GitLab) for exposed secrets including API keys, passwords, and certificates.
- Analyze cloud configurations and environment var...
Capacity Estimation
-
Assumptions:
- Each tenant has an average of 500 code repositories, 200 cloud configurations, and 100 container images.
- We expect to scan 10,000 tenants.
-
Calculations:
- T...
Submit Your Answer
