It seems like that hardcoded secrets like passwords in the following format are not being detected by SonarQube’s secret detection rules. Anyone knows the reason? apiVersion: apps/v1 kind: Deployment metadata: name: app spec: replicas: 3 selector: matchLabels: test.kubernetes.io/name: app …

Hello and thank you very much for your feedback! This would be a great example for our rule S6437 ! Unfortunately this rule is not yet available for Kubernetes. Since we are constantly improving our secret detection we hopefully can add support for S6437 for Kubernetes in the near future. I hope …

Hardcoded secrets in YAML not detected

SonarQube Server / Community Build

Alexandre_Gigleux (Alexandre Gigleux) August 20, 2025, 1:52pm 8

Late is better than never. Sonar is now able to detect the case you shared with us.

See Sonar now analyzes YAML and JSON files for secrets for more details.

Topic		Replies	Views
Secret detection in yaml files SonarQube Server / Community Build scanner , security , secrets , yaml	1	247	November 27, 2024
Sonar now analyzes YAML and JSON files for secrets Sonar Updates security , secrets	6	646	March 17, 2026
Support of YAML/JSON by the Azure DevOps SonarCloud extension? Rules and Languages scanner	1	94	September 16, 2025
Regarding YAML rules whcih scans sensitive info in YAML SonarQube Server / Community Build	1	198	January 23, 2024
Secret Detection does not work SonarQube Server / Community Build secrets	1	103	April 22, 2025

Hardcoded secrets in YAML not detected

Related topics