Hardcoded secrets in Web.config not detected

SonarQube Server / Community Build
1

  • Version: Community Build 9.9.4.87374

  • SonarQube deployed: ZIP

  • What are we trying to achieve: SonarQube is not detecting secret patterns in the Web.config file inside the <appSettings> section, such as:

      	<add key="cyberdevops.username" value="user-gestion" />

        <add key="cyberdevops.password" value="testsonarqb" />

        <add key="cyberdevops.secret" value="testsonarqb" />

However, other types of patterns have been correctly detected, for example:

<rabbitMQConnectionSection Url="rabbitmq://localhost/" UserName="User2" Password="test2123" />
  • What have we tried so far to achieve this: we’ve tried different key patterns and various keywords to check if there was an issue with the key regex detection.

Thank you,
BR.
Alex.

3

Hi @AlexSV, welcome to Community!

Unfortunately, as of August 2025, we currently don’t support these generic secrets in ASP.NET configurations. I will add it to our backlog. Thanks for raising this issue!

Let us know if you have any other feedback, it helps us improve our product :grinning_face_with_smiling_eyes:

Best,
Gabin

6

And a quick note, only the latest version of SonarQube Community Build is considered active, so you’ll need to update and see if the situation is still replicable before we can help you.

Your update path is:

9.9.4 → 24.12 → 25.8

You may find these resources helpful:

If you have questions about upgrading, feel free to open a new thread for that here.