How to Enable Dynamic Token Validation and Review Secrets Scan Results

Use Case

A security team uses Secrets Scans in JFrog Xray to confirm that detected secrets are still active, then reviews scan results and acts on credential leaks.

Step 1: Enable Dynamic Token Validation

Goal: Check whether detected secrets are still active, reducing false alarms for expired or inactive credentials.

1. Navigate to Administration > Xray Settings > Advanced Security.
2. Locate the Enable Dynamic Token Validation option and enable it.
3. Save the settings.

Step 2: View and Manage Secrets Scan Results

Goal: Review, assess, and act on detected secrets to prevent credential leaks.

1. Navigate to Scans List > Repositories.
2. Select the relevant scan report to view detected secrets.
3. Review scan results, which include:
   • Severity classification: Critical, High, Medium, or Low.
   • Secret type: For example, API Key, OAuth Token, or SSH Private Key.
   • Suggested remediation actions: For example, revoke, rotate, or secure the secret.
4. Take necessary actions, such as revoking compromised secrets or configuring ignore rules.

For more information, see Understanding and Analyzing Xray Scan Results and Ignore Advanced Security Violations.

Related Topics

• Enable Advanced Scans
• Configure Advanced Security
• Advanced Security Policies