FortiDevSec Secret Scanner

FortiDevSec scans your git repository commits for hard coded secrets such as passwords, API keys, and tokens. Secret scanner will not scan the files in the git repository.

Note:

• Vulnerabilities will continue to be flagged as long as commits containing secrets remain in the git repository/branch.

Example:

The following example demonstrates how FortiDevSec secret scanner works.

Consider a sample python script file example.py. This file contains a hardcoded secret variable called access_token. When you commit the Python file to a git repository and run the FortiDevSec secret scan, FortiDevSec will identify and report the vulnerability.

Even if the access token is subsequently removed from the example.py file, it may still be identified by the secret scanner due to its presence in the commit history.

It is recommended to execute the secret scan on local development branches before pushing any commits containing secrets to the git repository.

To address and eliminate any reported secret vulnerabilities identified by FortiDevSec, remove the specific commit from the respective git repository/branch.