# \#secrets **URL:** https://community.sonarsource.com/tag/secrets/329.md [Latest](https://community.sonarsource.com/latest.md) · [Categories](https://community.sonarsource.com/categories.md) · [Tags](https://community.sonarsource.com/tags.md) --- ## [SonarQube CLI 1.10.0 - secrets allowlist, OpenCode integration and eased settings configuration](https://community.sonarsource.com/t/sonarqube-cli-1-10-0-secrets-allowlist-opencode-integration-and-eased-settings-configuration/189871)
**Author:** [@Farah](https://community.sonarsource.com/u/Farah)\ **Replies:** 0\ **Last updated:** [October 15, 2026, 12:04pm UTC](https://community.sonarsource.com/t/sonarqube-cli-1-10-0-secrets-allowlist-opencode-integration-and-eased-settings-configuration/189871 "2026-10-15T12:04:46Z")
Dear community, We’re excited to announce SonarQube CLI v1.10.0, a release that introduces a new sonar config command for persistent settings, adds OpenCode and secrets allowlist support, and delivers several reliabilit… --- ## [\# SonarQube CLI v1.6.0 – Better Vortex status and cleaner entitlement handling](https://community.sonarsource.com/t/sonarqube-cli-v1-6-0-better-vortex-status-and-cleaner-entitlement-handling/187574)
**Author:** [@Farah](https://community.sonarsource.com/u/Farah)\ **Replies:** 0\ **Last updated:** [August 19, 2026, 8:07pm UTC](https://community.sonarsource.com/t/sonarqube-cli-v1-6-0-better-vortex-status-and-cleaner-entitlement-handling/187574 "2026-08-19T20:07:10Z")
Dear community, We’re excited to announce SonarQube CLI v1.6.0, a release focused on making Vortex status easier to understand and keeping your CLI setup clean when entitlements change. So here is what’s new: Vortex S… --- ## [False negative rule S6418](https://community.sonarsource.com/t/false-negative-rule-s6418/186701)
**Author:** [@mvillanueva](https://community.sonarsource.com/u/mvillanueva)\ **Replies:** 3\ **Last updated:** [July 30, 2026, 1:11pm UTC](https://community.sonarsource.com/t/false-negative-rule-s6418/186701 "2026-07-30T13:11:29Z")
Dear all, I have detected what I think is a false negative in rule S6418 “Secrets should not be hard-coded” and/or S2068 “Credentials should not be hard coded”. Problem: Hardcoded password SuperSecretABCD1234!? not dete… --- ## [Secret Detection vs LOC](https://community.sonarsource.com/t/secret-detection-vs-loc/186394)
**Author:** [@Javier](https://community.sonarsource.com/u/Javier)\ **Replies:** 1\ **Last updated:** [July 24, 2026, 5:37am UTC](https://community.sonarsource.com/t/secret-detection-vs-loc/186394 "2026-07-24T05:37:56Z")
Hi, I’d like to clarify how sonar.text.inclusions interacts with LOC-based billing. As I understand it: sonar.text.inclusions adds files to the secrets-detection engine’s scope, separately from sonar.inclusions/sonar… --- ## [🎉 SonarQube CLI is now in Open Beta and it's available to everyone!](https://community.sonarsource.com/t/sonarqube-cli-is-now-in-open-beta-and-its-available-to-everyone/181112)
**Author:** [@Farah](https://community.sonarsource.com/u/Farah)\ **Replies:** 4\ **Last updated:** [May 20, 2026, 11:59am UTC](https://community.sonarsource.com/t/sonarqube-cli-is-now-in-open-beta-and-its-available-to-everyone/181112 "2026-05-20T11:59:57Z")
We’re excited to announce the public release of SonarQube CLI, now officially in Open Beta! This represents a significant advancement for how you interact with your SonarQube Cloud or Server instances, both within your … --- ## [Sonar now analyzes YAML and JSON files for secrets](https://community.sonarsource.com/t/sonar-now-analyzes-yaml-and-json-files-for-secrets/147141)
**Author:** [@Alexandre\_Gigleux](https://community.sonarsource.com/u/Alexandre_Gigleux)\ **Replies:** 6\ **Last updated:** [March 17, 2026, 9:37am UTC](https://community.sonarsource.com/t/sonar-now-analyzes-yaml-and-json-files-for-secrets/147141 "2026-03-17T09:37:36Z")
Hello Community, We’re excited to announce a significant enhancement to our secret detection capabilities: Sonar now analyzes YAML and JSON files for leaked secrets! The Problem YAML and JSON files are widely used to … --- ## [Introducing SonarQube Secrets CLI](https://community.sonarsource.com/t/introducing-sonarqube-secrets-cli/176790)
**Author:** [@Alexandre\_Gigleux](https://community.sonarsource.com/u/Alexandre_Gigleux)\ **Replies:** 2\ **Last updated:** [March 16, 2026, 2:15pm UTC](https://community.sonarsource.com/t/introducing-sonarqube-secrets-cli/176790 "2026-03-16T14:15:07Z")
Hello, I’m excited to share that we have just launched the beta version of the SonarQube Secrets CLI, and anyone can now request access. Sonar already provides a highly efficient way to detect leaking secrets, tokens, … --- ## [Pre-commit hook gives ERROR This CLI is only available with a SonarQube Server license or a So](https://community.sonarsource.com/t/pre-commit-hook-gives-error-this-cli-is-only-available-with-a-sonarqube-server-license-or-a-so/178800)
**Author:** [@Mrigakshi](https://community.sonarsource.com/u/Mrigakshi)\ **Replies:** 1\ **Last updated:** [March 12, 2026, 1:59pm UTC](https://community.sonarsource.com/t/pre-commit-hook-gives-error-this-cli-is-only-available-with-a-sonarqube-server-license-or-a-so/178800 "2026-03-12T13:59:41Z")
Must-share information (formatted with Markdown): Sonar Enterprise edition Pre-commit hook secret detection installed sonar.py and added secret and token to environment variables as per the documentation. Errror messa… --- ## [My .github/\*\*/\*.yml files are not indexed](https://community.sonarsource.com/t/my-github-yml-files-are-not-indexed/152821)
**Author:** [@CCFenner](https://community.sonarsource.com/u/CCFenner)\ **Replies:** 4\ **Last updated:** [November 25, 2025, 9:24am UTC](https://community.sonarsource.com/t/my-github-yml-files-are-not-indexed/152821 "2025-11-25T09:24:50Z")
Great news! Is there anything special to do? My .github/\*\*/\*.yml files are not indexed and do not show up in the code tab. --- ## [Sonar now analyzes "dotfiles" for secrets](https://community.sonarsource.com/t/sonar-now-analyzes-dotfiles-for-secrets/142453)
**Author:** [@Alexandre\_Gigleux](https://community.sonarsource.com/u/Alexandre_Gigleux)\ **Replies:** 0\ **Last updated:** [June 6, 2025, 9:12am UTC](https://community.sonarsource.com/t/sonar-now-analyzes-dotfiles-for-secrets/142453 "2025-06-06T09:12:45Z")
Hello Community, We’re excited to announce a significant enhancement to our secret detection capabilities that closes a common and critical security blind spot. Sonar now analyzes “dotfiles” and files located in “dot pa… --- ## [Sonarqube\`s rule secrets:S6290 does not see vulnerability in \*.ts files](https://community.sonarsource.com/t/sonarqube-s-rule-secrets-s6290-does-not-see-vulnerability-in-ts-files/149645)
**Author:** [@roma](https://community.sonarsource.com/u/roma)\ **Replies:** 1\ **Last updated:** [October 2, 2025, 7:47am UTC](https://community.sonarsource.com/t/sonarqube-s-rule-secrets-s6290-does-not-see-vulnerability-in-ts-files/149645 "2025-10-02T07:47:48Z")
properties: sonar.qualitygate.wait=true sonar.text.inclusions.activate=true sonar.text.inclusions=\*\*/\*.ts,\*\*/\*.sh,\*\*/\*.bash,\*\*/\*.zsh,\*\*/\*.ksh,\*\*/\*.ps1,\*\*/\*.properties, \*\*/\*.conf,\*\*/\*.pem,\*\*/\*.config,.env,.aws/config p… --- ## [Hardcoded secrets in Web.config not detected](https://community.sonarsource.com/t/hardcoded-secrets-in-web-config-not-detected/147179)
**Author:** [@AlexSV](https://community.sonarsource.com/u/AlexSV)\ **Replies:** 2\ **Last updated:** [August 28, 2025, 9:43am UTC](https://community.sonarsource.com/t/hardcoded-secrets-in-web-config-not-detected/147179 "2025-08-28T09:43:38Z")
Version: Community Build 9.9.4.87374 SonarQube deployed: ZIP What are we trying to achieve: SonarQube is not detecting secret patterns in the Web.config file inside the \ section, such as: \ **Author:** [@viva](https://community.sonarsource.com/u/viva)\ **Replies:** 2\ **Last updated:** [August 20, 2025, 1:52pm UTC](https://community.sonarsource.com/t/hardcoded-secrets-in-yaml-not-detected/138793 "2025-08-20T13:52:07Z") It seems like that hardcoded secrets like passwords in the following format are not being detected by SonarQube’s secret detection rules. Anyone knows the reason? apiVersion: apps/v1 kind: Deployment metadata: name: … --- ## [Secret analysis not picking up plaintext passwords in Terraform](https://community.sonarsource.com/t/secret-analysis-not-picking-up-plaintext-passwords-in-terraform/146939)
**Author:** [@fernandopj82](https://community.sonarsource.com/u/fernandopj82)\ **Replies:** 5\ **Last updated:** [August 19, 2025, 12:35pm UTC](https://community.sonarsource.com/t/secret-analysis-not-picking-up-plaintext-passwords-in-terraform/146939 "2025-08-19T12:35:48Z")
Hello, My company is running SonarQube v25.8.0.112029 CE in a docker container. We have a problem with Terraform files containing non-critical passwords (but secrets nonetheless) in them. However, the Secrets rules do… --- ## [.Env Files are not being scanned by Sonar Cloud](https://community.sonarsource.com/t/env-files-are-not-being-scanned-by-sonar-cloud/145475)
**Author:** [@Ashok\_Robert](https://community.sonarsource.com/u/Ashok_Robert)\ **Replies:** 1\ **Last updated:** [August 6, 2025, 9:30am UTC](https://community.sonarsource.com/t/env-files-are-not-being-scanned-by-sonar-cloud/145475 "2025-08-06T09:30:03Z")
Issue : SonarCloud Scanner is not able to identify the .env files for our project. The code Tab in sonar cloud does not list the .env files. They are not analyzed. Details: sonar.text.activate has been enabled / set t… --- ## [Secrets not detected in PLSQL package](https://community.sonarsource.com/t/secrets-not-detected-in-plsql-package/144628)
**Author:** [@jnewman](https://community.sonarsource.com/u/jnewman)\ **Replies:** 1\ **Last updated:** [July 18, 2025, 2:04pm UTC](https://community.sonarsource.com/t/secrets-not-detected-in-plsql-package/144628 "2025-07-18T14:04:56Z")
Using Bitbucket Cloud pipeline PLSQL Exploring the SonarQube Cloud Free Trial Have this example statement we use to connect to an LDAP that I’m using to test the secret scanning: l\_bind := dbms\_ldap.simple\_bind\_s( … --- ## [SonarQube can detect 400+ secret patterns](https://community.sonarsource.com/t/sonarqube-can-detect-400-secret-patterns/144119)
**Author:** [@Alexandre\_Gigleux](https://community.sonarsource.com/u/Alexandre_Gigleux)\ **Replies:** 0\ **Last updated:** [July 9, 2025, 1:28pm UTC](https://community.sonarsource.com/t/sonarqube-can-detect-400-secret-patterns/144119 "2025-07-09T13:28:44Z")
Dear Community, Our latest release brings a significant boost to secret detection: you can now benefit from over 400 distinct secret patterns, powered by 346 rules. This update includes 89 newly added rules, currently i… --- ## [Include additional Spring Boot properties in java:S6437](https://community.sonarsource.com/t/include-additional-spring-boot-properties-in-java-s6437/142372)
**Author:** [@furti](https://community.sonarsource.com/u/furti)\ **Replies:** 3\ **Last updated:** [June 13, 2025, 8:33am UTC](https://community.sonarsource.com/t/include-additional-spring-boot-properties-in-java-s6437/142372 "2025-06-13T08:33:16Z")
After Upgrading SonarQube Server from 9.9 to 2025.1, I played around a bit with the secret detection. On this journey I came across java:S6437. The rule exists since a while now but got a lot of enhancements since 9.9. S… --- ## [No secrets detected in .env files](https://community.sonarsource.com/t/no-secrets-detected-in-env-files/142465)
**Author:** [@sam.vimes](https://community.sonarsource.com/u/sam.vimes)\ **Replies:** 3\ **Last updated:** [June 10, 2025, 12:04pm UTC](https://community.sonarsource.com/t/no-secrets-detected-in-env-files/142465 "2025-06-10T12:04:42Z")
Hi, is this available in SonarQube Cloud, Team tier? Does it require configuration to enable? I have a test repo with .env files in it and they are not present in Code tab (expected behavior until this feature release). --- ## [Secret scanner misses the identification of login credentials in JS-Code](https://community.sonarsource.com/t/secret-scanner-misses-the-identification-of-login-credentials-in-js-code/137829)
**Author:** [@FSC](https://community.sonarsource.com/u/FSC)\ **Replies:** 3\ **Last updated:** [May 19, 2025, 9:33am UTC](https://community.sonarsource.com/t/secret-scanner-misses-the-identification-of-login-credentials-in-js-code/137829 "2025-05-19T09:33:39Z")
In a customer project we do have one JavaScript-file for which we already know that it contains login credentials which are leftover from the development process. The specific snippet are the following lines: \[...\] FC\_… --- ## [Secrets are not getting Discovered by Sonarcloud](https://community.sonarsource.com/t/secrets-are-not-getting-discovered-by-sonarcloud/140540)
**Author:** [@Lukasz1](https://community.sonarsource.com/u/Lukasz1)\ **Replies:** 1\ **Last updated:** [May 8, 2025, 8:30am UTC](https://community.sonarsource.com/t/secrets-are-not-getting-discovered-by-sonarcloud/140540 "2025-05-08T08:30:51Z")
Hello Guys, We are setting up Sonarcloud for our client which has currently Legacy Pricing tier. We want to discover secrets every time it is committed to the repository. We have enabled all quality rules to discover se… --- ## [Secret Detection does not work](https://community.sonarsource.com/t/secret-detection-does-not-work/138745)
**Author:** [@sbhaskar](https://community.sonarsource.com/u/sbhaskar)\ **Replies:** 1\ **Last updated:** [April 22, 2025, 9:04am UTC](https://community.sonarsource.com/t/secret-detection-does-not-work/138745 "2025-04-22T09:04:29Z")
Must-share information (formatted with Markdown): which versions are you using: sonarqube:2025-lta-developer how is SonarQube deployed: Docker what are you trying to achieve: scan sensitive values in my bitbucket repos… --- ## [Secret detection does not work with sonarqube community edition 25.3.0 for non-code files like ini](https://community.sonarsource.com/t/secret-detection-does-not-work-with-sonarqube-community-edition-25-3-0-for-non-code-files-like-ini/136822)
**Author:** [@Ripunjay](https://community.sonarsource.com/u/Ripunjay)\ **Replies:** 15\ **Last updated:** [April 9, 2025, 2:52pm UTC](https://community.sonarsource.com/t/secret-detection-does-not-work-with-sonarqube-community-edition-25-3-0-for-non-code-files-like-ini/136822 "2025-04-09T14:52:54Z")
Must-share information (formatted with Markdown): which versions are you using (SonarQube Server / Community Build, Scanner, Plugin, and any relevant extension) 25.3.0.104237 how is SonarQube deployed: zip what are you… --- ## [Isn't storing secrets in environment variables not safe?](https://community.sonarsource.com/t/isnt-storing-secrets-in-environment-variables-not-safe/138097)
**Author:** [@Philippe\_Formulain](https://community.sonarsource.com/u/Philippe_Formulain)\ **Replies:** 2\ **Last updated:** [April 3, 2025, 5:09pm UTC](https://community.sonarsource.com/t/isnt-storing-secrets-in-environment-variables-not-safe/138097 "2025-04-03T17:09:21Z")
I’m reading some of the secret rules descriptions, and something looks strange to me: you seem to officially recommend to store secrets in environment variables. Typically: Code examples Noncompliant code example pro… --- ## [Secret detection not finding problems on Dockerfile](https://community.sonarsource.com/t/secret-detection-not-finding-problems-on-dockerfile/138055)
**Author:** [@Eidil](https://community.sonarsource.com/u/Eidil)\ **Replies:** 3\ **Last updated:** [April 3, 2025, 12:24pm UTC](https://community.sonarsource.com/t/secret-detection-not-finding-problems-on-dockerfile/138055 "2025-04-03T12:24:45Z")
which versions are you using: SonarQube 10.8, Scanner based on image sonarsource/sonarqube-scan-action@v3.1.0; how is SonarQube deployed: zip; what are you trying to achieve: to find secrets on Dockerfiles and .py files… --- ## [SonarQube for IDE: Visual Studio 8.15 - Enhanced secrets detection](https://community.sonarsource.com/t/sonarqube-for-ide-visual-studio-8-15-enhanced-secrets-detection/138179)
**Author:** [@Farah](https://community.sonarsource.com/u/Farah)\ **Replies:** 0\ **Last updated:** [April 3, 2025, 7:51am UTC](https://community.sonarsource.com/t/sonarqube-for-ide-visual-studio-8-15-enhanced-secrets-detection/138179 "2025-04-03T07:51:34Z")
Hello Visual Studio community, The SonarQube for IDE: Visual Studio version 8.15 is now available! This version includes mainly the sonar-text analyzer enterprise plugin update with 130 new secret detection rules added… --- ## [SonarQube for IDE: VSCode 4.19 - Enhanced secrets detections, analyzers updates](https://community.sonarsource.com/t/sonarqube-for-ide-vscode-4-19-enhanced-secrets-detections-analyzers-updates/138178)
**Author:** [@Farah](https://community.sonarsource.com/u/Farah)\ **Replies:** 0\ **Last updated:** [April 3, 2025, 7:46am UTC](https://community.sonarsource.com/t/sonarqube-for-ide-vscode-4-19-enhanced-secrets-detections-analyzers-updates/138178 "2025-04-03T07:46:25Z")
Dear VS Code community, SonarQube for IDE: VSCode 4.19 is now available! It includes analyzers’ updates, most importantly, the sonar-text analyzer enterprise plugin has 130 new secret detection rules. Learn more about … --- ## [SonarQube for IDE: IntelliJ 10.20 - Enhanced secrets detection and more improvements](https://community.sonarsource.com/t/sonarqube-for-ide-intellij-10-20-enhanced-secrets-detection-and-more-improvements/138176)
**Author:** [@Farah](https://community.sonarsource.com/u/Farah)\ **Replies:** 0\ **Last updated:** [April 3, 2025, 7:37am UTC](https://community.sonarsource.com/t/sonarqube-for-ide-intellij-10-20-enhanced-secrets-detection-and-more-improvements/138176 "2025-04-03T07:37:45Z")
Dear IntelliJ community, SonarQube for IDE: IntelliJ 10.20 is now available! This version brings some design and usability improvements for AI CodeFix in the IDE. Additionally, an improvement was made for the automati… --- ## [Sonar can detect 300+ secret patterns](https://community.sonarsource.com/t/sonar-can-detect-300-secret-patterns/138094)
**Author:** [@Alexandre\_Gigleux](https://community.sonarsource.com/u/Alexandre_Gigleux)\ **Replies:** 0\ **Last updated:** [April 1, 2025, 2:20pm UTC](https://community.sonarsource.com/t/sonar-can-detect-300-secret-patterns/138094 "2025-04-01T14:20:19Z")
Dear Community, We’ve just rolled out a major update, expanding our offering to over 300 secret patterns. In fact, we now cover an impressive 307 patterns with 255 rules. Among these, we’ve introduced 132 brand-new rule… --- ## [Secrets quality profile is not getting picked by sonarqube analysis](https://community.sonarsource.com/t/secrets-quality-profile-is-not-getting-picked-by-sonarqube-analysis/136546)
**Author:** [@Ankit\_Ramani](https://community.sonarsource.com/u/Ankit_Ramani)\ **Replies:** 4\ **Last updated:** [March 18, 2025, 4:37pm UTC](https://community.sonarsource.com/t/secrets-quality-profile-is-not-getting-picked-by-sonarqube-analysis/136546 "2025-03-18T16:37:17Z")
Hey Colin I’m using Sonarqube server v10.8.1 developer Edition . We are testing whether secrets are getting detected with Secrete QP. On trying this we are getting some issue, but not relevant issue related to AWS crede… [Next page](https://community.sonarsource.com/tag/secrets/329.md?match_all_tags=true&page=1&tags%5B%5D=secrets)