I use Sonarqube version developer edition v10.5 1 to scan the source code. However, I notice that the .env file is not analyzed. Does sonarqube no longer support scanning .env files?

Hey there. We don’t currently analyze dot-prefixed files. [image] Is it possible to find secrets in .env and .gitlab-ci.yml? SonarQube Thank you @tanian.cmc , and Welcome to the community! We are aware that the sensors currently ignore dot-prefixed files. This is on the …

Thank you for answer. Can you tell me the reason for not analyzing dot-prefixed files?

It’s ultimately a decision made nearly 14 years ago ( SONAR-1467 ), so I probably can’t get down to an exact “why” – but at least back then, it was rare for hidden files to be code that you cared about. However, I don’t think it’s safe for us to assume we should now analyze all hidden files, so we ha…

This is extremely important, mainly to .env files since developers could be mistakenly committing secrets into these files. One way this should at least be possible is by adding specific entries to the inclusions list in the sonar-project.properties file. i.e.: sonar.inclusions=**/.env,**/.env.* I…

As a follow up I’ve performed 3 tests: Added .env* to the sonar.inclusions Renamed .env.sample to sample.env Renamed .env.sample to sample.env and added *.env to the sonar.inclusions Neither worked, meaning that the problem of Sonar not scanning .env files does not seems only related to SonarScan…

I also tried the above pattern and all of them did not work.

Hi @felipeplets Have you checked if the .env extension is also mapped to the Secrets language? This is the default on SonarCloud, if I am not mistaken, but it might not be on SonarQube, depending on your version. If you have both this mapping and a file named sample.env, I believe it should be an…

Sonar is now able to scan .env files. See Sonar now analyzes "dotfiles" for secrets for more details.

The file .env is not analyzed

SonarQube Server / Community Build

Colin (Colin) September 27, 2024, 7:32am 3

Hey there.

We don’t currently analyze dot-prefixed files.

Topic		Replies	Views
Is it possible to find secrets in .env and .gitlab-ci.yml? SonarQube Server / Community Build scanner	3	208	June 6, 2025
.env file is not analyzed for secrets in SonarQube Server 25.1 SonarQube Server / Community Build sonarqube , scanner	2	37	April 21, 2026
.Env Files are not being scanned by Sonar Cloud SonarQube Cloud secrets , sonarqube-cloud	1	83	August 6, 2025
Scanning not taking named env files into account SonarQube Cloud	6	59	May 6, 2026
No secrets detected in .env files SonarQube Cloud secrets	3	116	June 10, 2025

The file .env is not analyzed

Related topics