VaultPilot Discovery is a workspace where approved operators review exposure findings within an approved scope. It points to login surfaces, certificate risks, and files that may hold secrets outside the encrypted vault.
Discovery is not PAM, asset inventory, RDP or SSH management, vulnerability scanning, malware scanning, or data cleanup automation. It collects signals; the operator decides what happens next.
Finding evidence is masked to the detail an authorized review needs. A signal stays a review candidate until an operator confirms its scope and meaning.
What Discovery reviews
| Area | What VaultPilot checks | Operator boundary |
|---|---|---|
| Private network and TLS | Approved private IP, CIDR, range, TCP, TLS, and passive HTTP login markers. | No public internet scan by default. No credential submission. |
| Windows folder presets | Desktop, Documents, Downloads, OneDrive, Public desktop, and Public documents for the server runtime account. | Presets prepare scope, but the operator must still confirm read-only file scanning. |
| Approved local or SMB paths | Explicit paths that the operator is authorized to review. | System directories and VaultPilot’s own data folders are rejected. |
| Documents and admin files | Text, Office, CSV/TSV, Excel OOXML, env/config, scripts, registry exports, VPN/RDP, Terraform, kubeconfig, Docker config, package-manager credential files, certificates, and key-like files. | Findings store metadata, hashes, and redacted evidence, not plaintext secret values. |
What it never does
- It does not brute force, spray passwords, test default credentials, bypass access controls, or submit login forms.
- It does not read LSASS, SAM, NTDS, browser password stores, Windows Credential Manager, or DPAPI user secrets.
- It does not store raw passwords, API keys, tokens, private keys, connection strings, vault keys, cookies, HTTP bodies, Excel cell contents, or full matched lines.
- It does not modify, delete, quarantine, or clean source files.
- It does not import anything into a vault unless an operator marks a finding ready and the vault is unlocked.
Operator workflow
- Open Security > Discovery.
- Name the scan so the purpose is clear to a later reviewer.
- Select a network/TLS scope, Windows folder presets, approved local paths, or approved SMB paths.
- Confirm the read-only file-scan approval when file scope is selected.
- Review file limits, extensions, timeout, concurrency, and ports before saving.
- Use Preview to check the scan plan without scanning, or Run after the confirmation prompt.
- Triage findings by status, signal strength, type, and asset.
- Mark noise as ignored or suppressed with a reason.
- Mark real file findings as ready for import only after the owner confirms they belong in the vault.
- Import ready findings while the vault is unlocked. VaultPilot re-reads the approved value only for the import and stores it as an encrypted vault record.
Findings review
Findings are signals, not secrets. A finding can show:
- detector and candidate type,
- severity and confidence,
- asset identity or masked path,
- redacted evidence,
- path hash and evidence hash,
- review decision,
- whether the finding can become a vault record.
Use the detail drawer before any decision. If evidence is too weak, keep it in review or suppress it with a reason instead of importing it.
Import handoff
Import rules:
- Only findings marked ready for import appear in the import step.
- The value is re-read from the approved source during the import.
- The browser encrypts the value with the unlocked vault key.
- The server stores the encrypted vault item, redacted finding metadata, and audit events.
- Plaintext discovered values are not persisted.
Safe evidence for support
When asking for help, send only:
- scan name and run timestamp,
- selected scope type, not real secret-bearing paths unless redacted,
- detector, severity, confidence, candidate type, status, and redacted evidence,
- path hash and evidence hash,
- whether the vault was locked or unlocked during import,
- relevant component version.
Do not send raw source files, screenshots with real secret records, unmasked paths, tokens, private keys, database files, backups, or vault exports.