Create Custom Secrets Scanner

The Custom Secrets scanner lets you define search patterns to detect sensitive information in your artifacts and source code, scanning both binary and text files.

JFrog Advanced Security includes built-in secret detection, but your organization may have unique secrets or patterns that require a customized approach.
Custom Secrets scanners allow you to define specific patterns using RE2 regular expressions and seamlessly integrate them into the Advanced Security scanning process. This ensures comprehensive secret detection across your entire software development lifecycle.

• Create Custom Scanner
• Manage Existing Custom Scanners

Before You Begin

Consider these regex best practices:

• Craft regex patterns carefully to prevent performance issues and false positives.
• Thoroughly test regex patterns before deployment.

JFrog Xray uses the RE2 regex engine, so your patterns must follow RE2 syntax. For more information, see RE2 syntax.

Create Custom Scanner

Create a custom scanner when built-in secret detection doesn't cover a pattern you need to find.

To create a custom scanner:

1. In the Xray Administration tab, go to Xray Settings.
2. Select Custom Scanners.
3. Select Create New Scanner.
4. Fill in the following fields:
   1. Name: A descriptive name for your scanner.
   2. Description: A detailed explanation of the scanner's purpose. The scan result displays this description when a matching secret is detected.
   3. Severity: Assign a severity level of High, Medium, or Low to identified secrets.
   4. CWE (optional): Associate a relevant CWE for better vulnerability tracking.
   5. Scanner Code: The regular expression pattern to search for.
   6. Notes (optional): Any additional information about the scanner.
5. Select Save.

Example Scanner Settings

To detect API keys with the prefix API_KEY_, you can create a custom scanner with the following settings:

• Name: API Key Scanner.

• Description: Detects API keys with the API_KEY_ prefix.

• Severity: High.

• Regex:

  Text

  API_KEY_[a-zA-Z0-9]{32}

Manage Existing Custom Scanners

You can enable, disable, edit, delete, or view a scanner after you create it.

To manage an existing custom scanner:

• In the Custom Scanners view, you can:
  • Enable or Disable: Activate or deactivate a scanner. Scans use only enabled scanners.
  • Edit: Modify an existing scanner's settings.
  • Delete: Remove a custom scanner.
  • View: See details about each scanner.

Custom Scan Results

You can view custom scan results in Xray's Scan List.

Related Topics

• Configure Advanced Security
• Enable Advanced Scans
• Ignore Advanced Security Violations