PSSecretScanner - As a VSCode Extension

Disclaimer: This is coded using the Github copilot app. I have verified and gone through the code as good as I can, but just so you know there is slop in here.

Disclaimer 2: If you want to clone and play with this repo you may want to turn of GitHub / Azure DevOps secret push protection. It will not allow you to push changes to the repo...

This extension Build on the foundation of PSSecretScanner and the pattern I have collected and verified over the years. It just made more sense to have it as an extension I think.

The extension scans the active editor using regex patterns from config.json and marks matches with diagnostics:

• Error: Found a secret
• Warning: Found a secret that is part of an exclude list.

Hover over the twiggly and you will get more info on what patterns and / or exclusions are found.

Configurations

I try to keep it simple, but some settings are possible to do by going to your preferences -> Settings -> Extensions -> Secret Scanner:

• Config path. If you have a custom config.json file you can use this instead. Probably not a good thing to do for most, but good for testing new patterns for example. See below for info on the Config.json file.
• Bring your own patterns. Your VSCode settings.json can hold custom patterns for your own thingamajigs. Just add them in the following format

"secretScanner.customPatterns": [
        {
            "name": "Test Secret",
            "pattern": "TEST_SECRET_[A-Z0-9]{6}"
        }
    ]

• Exclude List Path. Any secret exclusions you save by selecting "Add to VSCode ignore file" is saved here. This should be persistant over reinstalls or upgrades. You can open this file using the Command palette (F1) and search for Secret Scanner: Open VSCode .ignoresecrets.
• Scan on active editor change and Scan on save. Does what they say.
• Show ignored secrets. Defaults to "on". This setting makes secrets that are actively ignored in a .ignoresecrets file still show up as warnings. Uncheck to make them not show up at all.

These settings can of course also be set directly in the VSCode settings.json using the following values:

• secretScanner.configPath
• secretScanner.excludeListPath
• secretScanner.customPatterns
• secretScanner.scanOnSave
• secretScanner.scanOnActiveEditorChange
• secretScanner.showIgnoredSecrets

Commands

Some commands are also included. You can find these in the command palette (F1 in VSCode on windows) by typing Secret scanner. Two of these commands may be of interest:

• Open VSCode .ignoresecrets. This.. opens the VSCode ignoresecrets file. Good if you need to edit or change anything there - such as adding wildcard exclusions.
• Open Config.json (Risky). Technically, opening this file isn't risky. Neither is changing it. But if you do change it I take no responsibility for any crashes that may occur. Regex is 99% magic. Use the customPatterns setting instead for adding stuff, open this to marvel at the nightmare patterns.

The rest of commands are pretty self explanatory.

Ignore files or false positives

There are places where you actually want secrets. There are also places where you get false positives. One such example is the ignore list format examples here below. These can be handled by using ignorelists.

In about 99% of these cases you will want to have a repo wide .ignoresecrets file. The only reasonable exclusion to this rule is if you are not using git, or if you share passwords regularly in files - In which case I know a hacker or two who wants to know where you work.

About the .ignoresecrets file(s)

The filename of ignorelists must be .ignoresecrets. Nothing else.

There are two separate locations we look for .ignoresecrets files:

• If the open folder or file lives in or is a git repository we will look in the git root folder. For example:
  • In VSCode I open the git folder C:\git\myThing.
  • The file C:\git\myThing\.ignoresecrets is included
  • The file C:\git\myThing\mySubthing\.ignoresecrets is not included
• VSCode secretScanner.excludeListPath. If this setting is set to something, we look there, if not this deafults to <extension global storage>\.ignoresecrets

If both files exist, exclusions from both are applied.

About the .ignoresecrets content format

The format of the .ignoresecrets file is exactly the same as it is in PSSecretScanner. It supports relative or fixed paths, wildcards, full file exclusions, or detailed exclusions. You may, for example, use this as a starter with examples:

# Comments supported

# Relative paths supported (starting with .\)
# NOTE! Relative paths are calculated _relative_ to the excludelist path.
# If this file is located in c:\mypath\.ignoresecrets
.\Docs\Help\Find-Secret.md
.\Source\config.json
# The resolved exclude paths will be c:\mypath\Docs\Help\Find-Secret.md and c:\mypath\Source\config.json

# Wildcards supported. All files within this and subfolders will be excluded.
.\bin\*

# Paths to files. All matches in these files will be excluded
.\Tests\RegexPatternTests\TestCases.json
C:\MyRepo\PSSecretScanner\README.md

# Patterns on specific lines supported in the format
# <path\to\file>;<line number>;<pattern>
.\ExcludeList.csv;1;"C:\BicepLab\template.json;51;-----BEGIN RSA PRIVATE KEY-----"
C:\MyRepo\PSSecretScanner\Docs\Help\Find-Secret.md;51;"C:\MyFiles\template.json;51;-----BEGIN RSA PRIVATE KEY-----"

Because the relative paths are resolved from the .ignoresecrets file there will be weirdness if you use wildcards in the VSCode .ignoresecrets file! Use a repo one to be safe

About the automatic exclusion fixes

There are quick fixes for exclusions built in. If a red or yellow twiggly is shown, you can hover over it, and choose "Quick fix". There are two fixes built in:

• Add to VSCode ignore file.
• Add to repository ignore file.

If the latter is picked and you are not currently in a file belonging to a repository you will get an error and no ignore will be created.

In both cases, if no existing file is there already it will be created for you.

The exclusions here will always have the format <path\to\file>;<line number>;<pattern>. Because this exclusion uses line numbers it is prone to change a lot and manual updates of the file(s) may be needed.

What about PSSecretScanner? Is it dead and replaced now?

It is not dead, by no means, it just.. does what I need it to. If I find any new secrets I will add them to both repos and create separate releases.

Local development

1. npm install
2. npm run compile
3. Press F5 in VS Code to launch Extension Development Host.

Package

npm run package