Masking detected secrets in source code

Masking detected secret values in source-code views and Web API responses in SonarQube Server 2026.5.

SonarQube Server can mask the value of secrets that a scan detects in your code, instead of showing them in plain text.

The Mask detected secret values in source code setting (sonar.security.secretSourceRedaction.enabled) is disabled by default. While disabled, SonarQube Server shows the secret value in the source-code view and in Web API responses that return source code. Enable the setting to hide these values instead.

Permissions

You must have the Administer System permission.

How it works

When you enable masking, SonarQube Server replaces detected secret values with a mask in the source-code view and in Web API responses that return source code. If SonarQube Server cannot determine a safe location to mask within a file, it masks the entire source of that file instead.

Masking applies only to how source code is displayed. Detected-secret issues, their locations, and their descriptions remain visible as usual.

Masking takes effect immediately for existing and new analyses. You do not need to reanalyze your code or restart your instance after changing the setting.

Enabling secret masking

To enable masking of detected secret values in source code:

1. Go to Administration > Configuration > General settings > Security.
2. Enable Mask detected secret values in source code.

Related pages

Secrets