Secrets
SonarQube Cloud supports the analysis of Secrets, pieces of user-specific or system-level credentials.
Secrets are pieces of user-specific or system-level credentials that should be protected and accessible to legitimate users only.
Configuring secret-specific parameters (general procedure)
To discover and update the Secret-specific properties, navigate in SonarQube Cloud to Your Project > Administration > General Settings > Languages > Secrets. See the Analysis parameters page for more information about specific properties.
Adjusting the secret detection scope
By default, SonarQube Cloud detects exposed secrets in all files processed by the language analyzers. You can refine the scope of the secret detection by:
Excluding hidden files from the analysis.
Adding files based on path-matching patterns.
Adjusting the binary file exclusion setup.
Analysis of hidden files
Depending on which scanner is used, additional hidden files tracked by Git are included in the secrets analysis.
This behavior can be disabled by setting the sonar.scanner.excludeHiddenFiles analysis parameter to true.
Analyzing additional hidden files is currently only partially supported with the SonarScanner for Maven and Gradle. Additional hidden files are only analyzed if they’re inside the src/main/java or src/test/java folder in the root or module directories.
Analyzing additional hidden files is currently not supported with SonarScanner for .NET.
Adding files based on path-matching patterns
If you’re using a git repository, you can add files to the secret detection scope by defining path-matching patterns: the files matching the patterns will be included provided they are tracked by git.
To add additional files to the secret detection:
In the SonarQube Cloud UI, go to Your Organization > Your Project > Administration > General Settings > Languages > Secrets.
Enable the Activate inclusion of custom file path patterns option.
In the List of file path patterns to include, adjust the default path-matching patterns if necessary. See the Defining matching patterns page for instructions.
Alternatively, configure the parameters listed below on the CI/CD host (see the Analysis parameters page for more information).
Property
Description
sonar.text.inclusions.activate
Enables the inclusion of files to the secret detection according to the path-matching patterns defined in sonar.text.inclusions.
sonar.text.inclusions
Comma-separated list of path-matching patterns.
Possible values: A path can be relative (to the sonar.projectBaseDir property, which is by default the directory from which the analysis was started) or absolute. See also the Defining matching patterns page.
Default value: **/*.sh,**/*.bash,**/*.zsh,**/*.ksh,**/*.ps1,**/*.properties, **/*.conf,**/*.pem,**/*.config,.env,.aws/config
Adjusting the binary file exclusion setup
SonarQube Cloud excludes binary files from the analysis. In case binary file types are still included in your analysis, you can exclude these additional files.
To do so:
In the SonarQube Cloud UI, go to Your Organization > Your Project > Administration > General Settings > Languages > Secrets.
In Additional binary file suffixes, enter the list of suffixes to be excluded.
Alternatively, configure the parameter below on the CI/CD host (see the Analysis parameters page for more information).
Property
Description
sonar.text.excluded.file.suffixes
Comma-separated list of additional binary file suffixes to be excluded.
Parallel code scan
By default, the analyzer tries to parallelize the analysis of compilation units; it spawns as many jobs as logical CPUs available on the machine.
If required, it is possible to customize the number of scheduled parallel jobs by configuring the property sonar.text.threads=n at the scanner level, where n is an integer indicating the maximum number of parallel jobs.
You should consider setting the sonar.text.threads property only when the automatic detection of the number of logical CPUs cannot detect the desired number. A typical example is when the analysis should not consume all the available computing resources to leave room for other tasks running in parallel on the same machine.
When setting the sonar.text.threads property, you should set it to a value less or equal to the number of logical CPUs available. Over-committing does not accelerate the analysis and can even slow it down.
Analysis of files that don't contain code
Files that don’t contain code (for example, build.gradle and sonar-project.properties) are scanned durning analysis and displayed in the SonarQube Cloud UI after an issue is detected in them. If no secrets are detected in those files, they are not displayed in the UI.
Deactivating secrets analysis
You can deactivate the analysis of secrets by setting the sonar.text.activate property to false.
Related pages
See Sonar's Secrets rules for static code analysis
Last updated
Was this helpful?