Secrets

When analyzing your code with NG SAST, your results will include secrets, or hard-coded values (e.g., client secrets, username/password combinations) and sensitive information (e.g., phone numbers and addresses), and any other vulnerabilities identified.

Before proceeding, please ensure that you have set up and authenticated with ShiftLeft. Then, analyze your application to obtain information about any secrets present in your application.

Scanning for secrets

ShiftLeft looks for secrets by default, though you may modify the configuration file to change ShiftLeft's default analysis behavior.

NG SAST also scans all *.properties files included for the presence of secrets.

Entropy

ShiftLeft CORE allows you to modify how the default analysis behaves, including how sensitive the analysis for hard-coded credentials is. This setting, called entropy, is a value between 0.0 and 1.0 (inclusive) and measures the analysis engine's certainty regarding the result. The default value is 0.0.

For example, the following table details the number of secrets identified in HelloShiftLeft based on the entropy value.

EntropyNo. of secrets detected
0.255
0.53
1.00

Viewing your results

The secrets that ShiftLeft identifies in your application will appear in the Vulnerabilities Dashboard.

To access your results:

  1. Log in to the ShiftLeft Dashboard and select the appropriate organization.
  2. In the list of Applications, find the one you're interested in and click to open.

You will see a summary page of all vulnerabilities identified by ShiftLeft, including secrets.

Vulnerabilities Dashboard Indicating Secrets Detected

Click the Secrets tab to display a list of the issues identified.

List of Identified Secrets in ShiftLeft's Dashboard

You can filter the results based on:

  • Its Status (which reflects any work that's been done by your team on the issue)
  • Who it is Assigned to for further action
  • One or more Advanced Filter, which allows you to specify the category (both general and OWASP) and the language of the code