exclude-secrets option is not working as expected

[meeragirijan]

We are trying to avoid disabling the plugin "keyword-detector" and use exclude-secrets option as part of the scan to exclude words that contain "secret" specifically. I have tried multiple regex variations to include this substring, which was validated through regex compilers, but we still get the JSON generated with these values tagged as secrets. What is the right approach to achieve this?

[jpdakran]

@meeragirijan Hello. Thank you for your question. Using the --exclude-secrets here is probably not the right approach. This will only filter according to the actual secret value - not the keyword (variable name).

What you probably want to use is the --exclude-lines. This will look at the entire line the secret is on. Therefore it will look at keyword, secret, and all text on that line.

[meeragirijan]

I have tried the same with --exclude-lines as well but I get the same result as the json. Is it possible that there is a specific way the regex is being evaluated ?

[meeragirijan]

I tried with a different regex and it seems to be working now with --exclude-lines option

[meeragirijan]

Using this with windows agent throws an exception on the same agent that this path is unavailable. Whereas when we run it wothout this option --exclude-lines it seems to work fine. Does this option have any specific version?

[jpdakran]

Hi @meeragirijan. It seems you were able to get this working on a specific os? Can you please provide the regex you are using, stack trace of the failing attempts, and specific command that is run.