Scanning and rules not being applicable on application.properties file of a java project

[Colin]

Hey @Sohel_Ahmed

You may want to look at this thread:

How to scan other project files for hard-coded secrets?

Hello, First you should know it is possible to customize the files that are considered by the Secret Detection engine in SonarQube Server or Cloud thanks to 2 properties: sonar.text.inclusions.activate sonar.text.inclusions This configuration has an impact only on these secret rules. application.properties files are normally used in the context of Spring and we have a pretty good coverage of Spring in general. I’m not aware of an entry called password.secret.key that could appear by defaul…

What @Alexandre_Gigleux discusses here is applicable to SonarQube Server v10.3+ and SonarQube Cloud.