ALM used (GitHub) CI system used (GHA) Scanner command used when applicable (default GHA workflow) Project is mostly Python and shell scripts Default Quality Profile for Secrets is the “SonarWay” default one. I’m trying to figure out why SonarCloud is not detecting secrets in a shell script file i…

Hi @mattmencel , welcome to the community. Thanks for your report. My guess is that the file you want the secrets detected in is not in the scope of the analyzer. For performance reasons currently only files are analyzed for secrets which are also touched by other analyzers. We are currently discu…

Hello, This is to keep you informed that we are working on a feature to allow you to define which files shall be scanned to find secrets. The related ticket is SONARTEXT-79 . Out of the box, Sonar tries to find secrets in files corresponding to a programming language that is supported by Sonar but…

Secret Scanning Profile - Projects show 0 vulnerabilities even when secrets are present

SonarQube Cloud

Alexandre_Gigleux (Alexandre Gigleux) Split this topic September 7, 2023, 1:31pm 6

A post was split to a new topic: Weird data on the Secrets Quality Profile

Topic		Replies	Views
.Env Files are not being scanned by Sonar Cloud SonarQube Cloud secrets , sonarqube-cloud	1	77	August 6, 2025
Secrets detection not working SonarQube Cloud universal	6	109	December 15, 2025
Is it possible to find secrets in .env and .gitlab-ci.yml? SonarQube Server / Community Build scanner	3	203	June 6, 2025
No secrets detected in .env files SonarQube Cloud secrets	3	106	June 10, 2025
SonarCloud Secrets Quality Profile Report False-positive / False-negative... secrets , sonarqube-cloud	9	397	December 21, 2023

Secret Scanning Profile - Projects show 0 vulnerabilities even when secrets are present

Related topics