Do I need secrets detection for logs and build artifacts?

Yes — logs and build artifacts should be included in secrets detection.

Why

Secrets often leak into places people don’t think about:

• Logs: debug output, stack traces, exception messages, request/response dumps
• Build artifacts: compiled bundles, container images, packaged configs, generated files, test reports

If a secret ever gets written there, it may:

• persist longer than the source code
• be copied to other systems
• be accessible to more people/processes than intended
• evade normal code-focused secret scanning

Practical guidance

You should scan:

• source code
• commits and history
• CI/CD logs
• test output
• build artifacts
• release artifacts
• container images
• deployment manifests and generated config files

Important nuance

Not every artifact needs the same handling:

• High-value artifacts: definitely scan
• Ephemeral logs: at least scan in CI, and sanitize/redact by default
• Large binary artifacts: scan if they can contain embedded config, strings, or packaged secrets

Best practice

Use a combination of:

1. Prevent secrets from being logged or bundled
2. Scan logs/artifacts in CI/CD
3. Redact or mask sensitive values
4. Rotate any secret that appears in a log or artifact

Bottom line

Yes, include logs and build artifacts in secrets detection.
If you want, I can also give you a recommended secrets-detection scope checklist for CI/CD pipelines.