Secret Scanner

Secret Scanner is a tool that will help you and your company keep your repositories and Work Items clean from confidential and sensitive data that might cause security issues and leaks or violate GDPR laws.

Scan your commits for secrets like passwords, API keys, usernames and other sensitive data. The scanner can also be used for ensuring GDPR compliance in your repositories.

Background

Secrets and other sensitive data like personal data are frequent findings in software development repositories. Scans made by security researchers find that 16% of repositories on GitHub contain some form of secrets that should not be exposed.

Overview

Secret scanner scans every commit as soon as the commit has made its way to Azure DevOps or GitHub. Potential secrets are then compared against an Exemption list. If a potential secret is not in the exemption list the scanner will alert both the developer and the Security Officer.

Secret scanner’s highly configurable workflow enables for swift mitigation of potential security issues, securing your internal and production environments with little effort.

Features

• Simple configuration. Configure once per Azure DevOps project.

• Supports both on prem and cloud Azure DevOps and GitHub installations.

• Continuous scanning of commits and work items based on rulesets that fits your organization.

• Filter system for whitelisting of matches.

• Extendable filter system that enables secret validation against password managers.

• Configurable alert system.

• Web UI for manual whitelisting of secrets

• Everything packaged in containers for simple deployment.

List of suspicious changes

The system will provide view of all suspicious activities from both Work Item Changes and Git commits.

Whitelisting

Functionality to whitelist and exempt result from future alerts.

Powerful statistics

Use statistics to track changes over time and identify areas where to improve.

Scan multiple scan sources from one tool

Secret Scanner enables your company to scan multiple sources from one tool.

If you would like to know more or schedule a demo, please contact us at info@solidify.se For a full list of our services, products and courses visit www.solidify.dev