Secret scanning

TL;DR

1. What is found

The scan reads the raw source line by line, so labels, notes, attributes, comments and pasted JSON are all covered. Each finding has a code, a line, a column, a kind and a hint.

What is left alone

A diagram that documents where a key goes should not be flagged for it. These are never findings:

Private addresses and internal hostnames are left alone too, unless an organisation turns them on, because an architecture diagram usually means them.

2. The warning everyone gets

A finding is a warning, never an error, so a draw, a check and a render all go ahead:

warning W701: This looks like a GitHub token (ghp_********); remove it before you publish or commit.   3 | node ci service "CI ****************************************"     |                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^hint: Put a placeholder such as <github-token> or a reference such as ${NAME} in its place, and rotate the value if it was ever shared. The scan matches patterns, so it can miss a secret or name a value that is not one.

The command line stars out every secret on the line it shows, under any message, so a CI log never carries one. In CI, plotwork validate --strict and the Action's fail-on: warning fail on a secret warning; the style suggestions W204, W205 and W5xx still pass.

3. Block at the library (organisations)

On the organisation's Settings tab, Secret scanning before publish has two choices. The owner and the admins change it; every member can read it.

Block covers every way into the library: a publish from an agent, the API or the command line, "Agents publish every diagram they draw", a save in the portal's editor, and sharing a diagram at a public link, which checks the stored picture. The answer is data, not an exception: its details.findings lists every finding with its code, line, column, kind and masked value. An agent is told to remove each one and publish again, and the editor lists them under its bar. Block is the Security item Block secrets in published diagrams in Recommended settings.

A personal account is never blocked, whatever an organisation it belongs to chose.

4. Private addresses and internal hostnames

Under Block, an organisation can also find:

Both count only under Block, and only for a publish to that organisation's library.

5. What the audit log records

Neither ever holds a value, a masked value or a hostname pattern. On Enterprise both are sent to your SIEM like every other event; see Send audit events and drift to your tools.

6. Not a guarantee

Detection is pattern-based. It finds credentials with a known shape and random values assigned to secret-like names, and it can miss a password that is a plain word, a key of a format it does not know, or a secret split across lines. It can also name a value that is not a secret. Treat it as a second pair of eyes, keep secrets out of diagram source in the first place, and rotate any value that was published.

See also