Masking detected secrets in source code

As an organization administrator, you can mask detected secret values in source-code views and Web API responses for your organization.

Overview

SonarQube Cloud can mask the value of secrets that a scan detects in your code, instead of showing them in plain text.

The Mask detected secret values in source code setting (sonar.security.secretSourceRedaction.enabled) is disabled by default. While disabled, SonarQube Cloud shows the secret value in the source-code view and in Web API responses that return source code. As an organization administrator, you can enable the setting to hide these values instead.

When you enable masking, SonarQube Cloud replaces detected secret values with a mask in the source-code view and in Web API responses that return source code. If SonarQube Cloud cannot determine a safe location to mask within a file, it masks the entire source of that file instead.

Masking applies only to how source code is displayed. Detected-secret issues, their locations, and their descriptions remain visible as usual.

Masking takes effect immediately for existing and new analyses. You do not need to reanalyze your code after changing the setting.

Permissions

You need the Administer Organization permission to enable secret masking for an organization. To change the permissions, retrieve your organization and go to Administration > Permissions to apply the permission to users or groups.

Enabling secret masking

To enable masking of detected secret values in source code:

1. Retrieve your organization. See Retrieving your organizations for more information.
2. Go to Administration > Organization settings > Security.
3. Enable Mask detected secret values in source code.

Related pages

• Secrets

• Managing organization permissions