detecting-sensitive-data-exposure

Run the scan_secrets.py script against your project directory to detect hardcoded passwords, API keys, AWS keys, GitHub tokens, and PEM private keys across properties, YAML, XML, Java, and JSP files. It uses Semgrep when available and falls back to regex patterns otherwise.

Check application.yml for plaintext passwords, @Value annotations with secret default values, log statements containing passwords or personal data, and DTO classes with password fields missing @JsonIgnore. The Skill's Semgrep ruleset covers all of these patterns for Spring projects.

Yes, the scanner falls back to regex-based detection when Semgrep is not installed. However, the fallback engine has lower recall, so a zero-finding result does not guarantee safety, and the tool prints a warning in that case.

They are not true positives. Values like ${DB_PASSWORD} are safe references, and the scanner explicitly excludes them from findings. The AI verification step further filters placeholders, public reCAPTCHA site keys, and test fixtures from confirmed vulnerabilities.

Yes, the scanner flags long Base64-looking string literals assigned to credential variables. The verification step then decodes the value to confirm whether it is an actual API key or password before classifying it as a vulnerability.

Regex scanning produces candidates rather than confirmed vulnerabilities and can miss obfuscated or split secrets. Lines longer than 5000 characters are skipped to avoid regex backtracking, and final verdicts require contextual review of each candidate.