Exposures Policy

An Exposures policy in JFrog Advanced Security detects exposed secrets, weak service settings, application misconfigurations, and Infrastructure as Code misconfigurations.

To create an Exposures policy:

1. Navigate to Application > Xray > Watches & Policies.
2. In the Policies tab, click New Policy.
3. Enter a Policy Name.
4. (Optional) Add a Description explaining the policy's purpose.
5. Under Select Policy Type, select Security.
6. Click Next.
   The Create New Policy Rule window opens.
7. Enter a Rule Name.
8. Under Rule Type, select Exposures.
9. Under Select at least one category, select one or more exposure categories for the policy to detect:
   • Secrets: Detects exposed credentials, tokens, and other sensitive data across source and binary scans. You can ignore specific findings to manage known safe secrets and minimize false positives.
   • Services: Identifies configuration issues or weak settings in common services and frameworks.
   • Applications: Detects misconfigurations and insecure library use within application logic.
   • IaC: Scans Infrastructure as Code files, including Terraform, to identify security misconfigurations before deployment.
10. From the Select minimal severity menu, select the severity level to trigger the policy violation.
11. Under Then, define the policy actions.
12. Select Save Rule.
13. Click Next.
14. Under Apply on Scope, select one or more policy watches.
15. Click Save Policy.

Related Topics

• Advanced Security Policies
• Configure Advanced Security
• Create a Contextual Analysis Policy