Scan for secrets

Documentation Index

Fetch the complete documentation index at: https://docs.semgrep.dev/llms.txt

Use this file to discover all available pages before exploring further.

This document guides you through:

1. Enabling Semgrep Secrets and scanning your repository
2. Configuring your ignore files
3. Upgrading your Semgrep Code rules to Semgrep Secrets rules

​

Language and environment support

Semgrep Secrets can scan repositories using any programming language and supports the posting of pull request (PR) and merge request (MR) comments to GitHub, GitLab, and Bitbucket.

​

Enable Semgrep Secrets

​

Scan your repository

Once you’ve enabled Secrets for your organization, all Semgrep scans include secret scanning. You can:

• Manually trigger a full scan of your repository through your CI provider
• Start a scan from the CLI (Semgrep recommends that you run CLI scans only on feature branches, not main branches)
• Wait for your scheduled Semgrep full scan
• Open a pull request or merge request and wait for Semgrep to scan the branch automatically

​

Configure files to ignore

Semgrep Secrets scans all files, even those specified in a local .semgrepignore file, since secrets can often be found in files that aren’t relevant for code scanning. To specify files that Semgrep Secrets should ignore:

​

Upgrade your rules

If you’re using Semgrep Code rules to identify leaked credentials, you’ll see prompts in Semgrep AppSec Platform indicating that there’s an improved version that uses Semgrep Secrets’ feature set, primarily its validators, which can validate whether the detected credential is active, and improvements in detecting and hiding false positives. You can see individual findings for which there is a Semgrep Secrets rule upgrade in Semgrep AppSec Platform’s Findings page. The findings are tagged with a label that says Secrets version available! Click to see rule(s). To see the rules you’re using for which there is a Secrets rule upgrade in Semgrep AppSec Platform:

​

Next steps

• Scan your Git history for secrets and scan for generic secrets.
• Learn how to view your findings in Semgrep AppSec Platform.
• Learn more about the structure of rules for Semgrep Secrets, as well as how to manage your rules using Semgrep AppSec Platform.
• Learn how to write custom validators for your Semgrep Secrets rules.