Is it possible to find secrets in .env and .gitlab-ci.yml?

SonarQube Server / Community Build
1
  • which versions are you using (SonarQube 10.5)
  • how is SonarQube deployed: Docker
    I need to see secrets from .env and .gitlab-ci.yml files in Sonar
    I tried to follow this manual but it says that files beginning with dot will not be analyzed. And then I tried to use truffelhog integration, everything works good except for these two files.
INFO: Sensor Import external issues report
INFO: Imported 3 issues in 2 files
INFO: External issues ignored for 2 unknown files, including: .env, .gitlab-ci.yml
INFO: Sensor Import external issues report (done) | time=52ms

Why are they ignored? Is it somehow possible to make Sonarqube see those secrets? we have UNIX based systems everywhere. Thank you very much for any piece of advice!

3

Thank you @tanian.cmc, and Welcome to the community!

We are aware that the sensors currently ignore dot-prefixed files. This is on the list of issues we are considering. I will add a note of your post to link to it.

Denis

5

Thank you Denis! I will be waiting for the news!