Design a Secrets Detection System

Last updated: December 9, 2025

Quick Overview

Design a system that scans code repositories, cloud configurations, container images, and runtime environments for exposed secrets like API keys, passwords, and certificates across thousands of tenants.

Wiz
System Design
Software Engineer
Wiz
December 9, 2025
Software Engineer
Live Technical Session
System Design
Hard

13

12

1,608 solved


Design a system that scans code repositories, cloud configurations, container images, and runtime environments for exposed secrets like API keys, passwords, and certificates across thousands of tenants.

Exposed secrets are one of the most common and dangerous security issues in cloud environments. Wiz needs to detect secrets in diverse data sources (git repos, environment variables, config files, container layers) with high precision to avoid alert fatigue from false positives. The system must handle sensitive data with extreme care.

What the Interviewer Expects
  • Design scan pipelines for different data sources (repos, configs, container images)
  • Build a detection engine using pattern matching, entropy analysis, and verification
  • Minimize false positives through multi-signal validation
  • Handle the security of the detection system itself (it processes secrets)
  • Address scale and performance for continuous scanning
Key Topics to Cover
Pattern matching and entropy analysis
Secret verification and validation
Container image layer scanning
False positive reduction
Secure handling of detected secrets
How to Approach This
  1. Start by clarifying functional and non-functional requirements with the interviewer.
  2. Estimate the scale: QPS, storage, bandwidth. This drives your design decisions.
  3. Draw a high-level architecture first, then deep dive into 1-2 critical components.
  4. Discuss trade-offs explicitly (e.g., consistency vs availability, SQL vs NoSQL).
  5. Address failure scenarios, monitoring, and how the system handles 10x traffic spikes.
Possible Follow-up Questions
  • How do you verify whether a detected secret is actually valid and active?
  • How do you handle secrets that span multiple lines or are obfuscated?
  • What is your strategy for reducing false positives below 5%?
Sharpen Your Skills on Codemia

Practice similar problems with our interactive workspace, get AI feedback, and track your progress.

Practice System Design Problems
Sample Answer
Detection Architecture

Multi-stage detection pipeline: Stage 1 uses high-recall pattern matching (regex for known secret formats like AWS keys, GitHub tokens, private key he...

False Positive Reduction

Multi-signal scoring: a detected string gets a confidence score based on format match strength, entropy level, context (e.g., variable name is 'passwo...


Submit Your Answer
Markdown supported

Related Questions