Custom Secrets Scanner

The custom secrets scanner lets you define search patterns to detect sensitive information in your artifacts and source code, scanning both binary and text files.

JFrog Advanced Security includes built-in secret detection, but you may have unique secrets or patterns that require a customized approach. You can define specific patterns with RE2 regular expressions and integrate them into the Advanced Security scanning process. This ensures comprehensive secret detection across your entire software development lifecycle.

• Create a Custom Scanner
• Manage Existing Custom Scanners

Before You Begin

Consider these regex best practices:

• Craft regex patterns carefully to prevent performance issues and false positives.
• Thoroughly test regex patterns before deployment.

Follow RE2 syntax. JFrog Xray uses the RE2 regex engine. For more information about supported syntax and limitations, see RE2 syntax.

Create a Custom Scanner

A custom scanner searches artifacts and source code for a regular expression you define.

To create a custom scanner:

1. In the Xray Administration tab, select Xray Settings and then Custom Scanners.
2. Select Create New Scanner.
3. Fill in the following fields:
   1. Name: A descriptive name for your scanner.
   2. Description: A detailed explanation of the scanner's purpose. The scan result displays this description when a matching secret is detected.
   3. Severity: Assign a severity level of High, Medium, or Low to identified secrets.
   4. CWE (optional): Associate a relevant CWE for better vulnerability tracking.
   5. Scanner Code: The regular expression pattern to search for.
   6. Notes (optional): Any additional information about the scanner.
4. Select Save.

Manage Existing Custom Scanners

From the Custom Scanners view, you can activate, change, or remove a scanner.

To manage an existing custom scanner:

• In the Custom Scanners view, choose an action:
  • Enable or Disable: Activate or deactivate a scanner. Only enabled scanners are used in scans.
  • Edit: Modify an existing scanner's settings.
  • Delete: Remove a custom scanner.
  • View: See details about each scanner.

View Custom Scan Results

You can view custom scan results in the Xray Scans List.

API Key Scanner Example

To detect API keys with the prefix API_KEY_, you can create a custom scanner with the following settings:

• Name: API Key Scanner.
• Description: Detects API keys with the API_KEY_ prefix.
• Severity: High.

Use this regular expression.

API_KEY_[a-zA-Z0-9]{32}

Related Topics

• Secrets Scans
• Features and Capabilities
• Misconfigurations Scans