Skip to main content

Scan for secrets

Semgrep Secrets allows you to detect and triage leaked secrets and credentials and save time by prioritizing which secrets to rotate based on whether they're active and in use.

Semgrep Secrets page

This document guides you through:

  1. Enabling Semgrep Secrets and scanning your repository
  2. Configuring your ignore files
  3. Upgrading your Semgrep Code rules to Semgrep Secrets rules

Language and environment support​

Semgrep Secrets can scan repositories using any programming language and supports the posting of PR and MR comments to GitHub, GitLab, and Bitbucket.

Enable Semgrep Secrets​

Prerequisite

You have completed a Semgrep core deployment.

  1. Log into Semgrep AppSec Platform.
  2. Click Settings.
  3. On the Deployment tab, click the Secrets toggle to enable.

Once you've enabled Secrets for your organization, all Semgrep scans include secret scanning.

Scan your repository​

After you've enabled Semgrep Secrets, you can:

  • Manually trigger a full scan of your repository through your CI provider
  • Start a scan from the CLI (Semgrep recommends that you run CLI scans only on feature branches, not main branches)
  • Wait for your scheduled Semgrep full scan
  • Open a pull request or merge request and wait for Semgrep to scan the branch automatically

Configure files to ignore​

Semgrep Secrets scans all files, even those specified in a local .semgrepignore file, since secrets can often be found in files that aren't relevant for code scanning. To specify files that Semgrep Secrets should ignore:

  1. Sign in to Semgrep AppSec Platform.
  2. From the Dashboard Sidebar, select Projects > [Project name].
  3. Click Secrets to expand and display the Path Ignores box.
  4. Enter files and folders to ignore in the Path Ignores box.
  5. Click Save changes.

Upgrade your rules​

If you're using Semgrep Code rules to identify leaked credentials, you'll see prompts in Semgrep AppSec Platform indicating that there's an improved version that uses Semgrep Secrets' feature set, primarily its validators, which can validate whether the detected credential is active, and improvements in detecting and hiding false positives.

You can see individual findings for which there is a Semgrep Secrets rule upgrade in Semgrep AppSec Platform's Findings page. The findings are tagged with a label that says Secrets version available! Click to see rule(s).

Finding tagged as having a Secrets rule available

To see the rules you're using for which there is a Secrets rule upgrade in Semgrep AppSec Platform:

  1. Sign in to Semgrep AppSec Platform.
  2. Go to Rules > Policies > Code.
  3. Under Available rule upgrades, ensure that you've selected Secrets.

Filter to find rules for which there is a rule upgrade

Next steps​

Additional information​

Not finding what you need in this doc? Ask questions in our Community Slack group, or see Support for other ways to get help.