Configuration

epack-tool-scan-secrets works out of the box with sensible defaults, but can be customized for your environment.

Tool Requirements

Configuration Options

All configuration options are optional. The tool uses sensible defaults when no configuration is provided.

Available Detectors

The following detector types can be disabled via disabled_detectors:

Usage

Via epack CLI

# Run with defaults
epack tool run scan-secrets --pack ./my-evidence.epack

# Run with config file
epack tool run scan-secrets --pack ./my-evidence.epack --config scan-config.json

Via epack Build

Add to your build configuration to automatically scan during pack creation:

# epack.yaml
tools:
  scan-secrets:
    source: locktivity/epack-tool-scan-secrets@v1
    config:
      entropy_threshold: 4.0
      ignore_paths:
        - "testdata/**"
        - "*.test.json"
      disabled_detectors:
        - high_entropy

Configuration Examples

Reduce False Positives

Lower the entropy threshold and ignore test fixtures:

tools:
  scan-secrets:
    source: locktivity/epack-tool-scan-secrets@v1
    config:
      entropy_threshold: 5.0
      min_entropy_length: 30
      ignore_paths:
        - "testdata/**"
        - "fixtures/**"
        - "*.test.*"

Focus on Specific Secrets

Disable detectors you don't need:

tools:
  scan-secrets:
    source: locktivity/epack-tool-scan-secrets@v1
    config:
      disabled_detectors:
        - slack_token
        - high_entropy

Increase Sensitivity

Lower thresholds to catch more potential secrets (may increase false positives):

tools:
  scan-secrets:
    source: locktivity/epack-tool-scan-secrets@v1
    config:
      entropy_threshold: 3.5
      min_entropy_length: 16

Output Files

Warnings

The tool adds warnings to the pack's result.json for each detection:

{
  "warnings": [
    {
      "code": "SECRET_DETECTED",
      "message": "aws_access_key: Possible AWS Access Key ID detected",
      "path": "config/credentials.json"
    }
  ]
}

Examples

Basic Usage

Run the tool on an evidence pack:

epack tool run scan-secrets --pack ./my-evidence.epack

Interpreting Results

Clean Scan

{
  "total": 0,
  "by_type": {},
  "by_severity": {},
  "detections": []
}

No potential secrets were detected in the pack.

Detections Found

{
  "total": 2,
  "by_type": {
    "aws_access_key": 1,
    "password": 1
  },
  "by_severity": {
    "warning": 2
  },
  "detections": [
    {
      "path": "artifacts/config.json",
      "type": "aws_access_key",
      "description": "Possible AWS Access Key ID detected",
      "severity": "warning"
    },
    {
      "path": "artifacts/database.yml",
      "type": "password",
      "description": "Possible password pattern detected",
      "severity": "warning"
    }
  ]
}

Common Detection Scenarios

AWS Credentials

# Detected pattern
AKIAIOSFODNN7EXAMPLE
aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

Private Keys

-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEA0Z3VS5JJcds...
-----END RSA PRIVATE KEY-----

JWT Tokens

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U

Connection Strings

mongodb://user:password@localhost:27017/mydb
postgres://admin:secret@db.example.com:5432/production

Handling False Positives

If the tool flags legitimate values (e.g., test fixtures), you can:

1. Document known false positives in your pack metadata
2. Use separate test data that doesn't match secret patterns
3. Review detections as part of your pack validation process

Integration with CI/CD

Run secret scanning as part of your evidence pack pipeline:

# GitHub Actions example
- name: Scan for secrets
  run: |
    epack tool run scan-secrets --pack ./evidence.epack
    # Check for warnings in result.json
    if jq -e '.warnings | length > 0' result.json > /dev/null; then
      echo "Warning: Potential secrets detected"
      jq '.warnings' result.json
    fi