CredScan Integration with DefectDojo

CredScan Integration with DefectDojo

Credential Scanner (CredScan) is a Microsoft tool that searches source code, configuration files, and build output for credentials and other sensitive content, such as default passwords, connection strings, and certificates with private keys. It ships with a set of "searchers," each targeting one kind of secret across many file types, and supports custom patterns. Microsoft delivered CredScan as part of the Microsoft Security Code Analysis (MSCA) extension for Azure DevOps Services, which Microsoft retired on March 1, 2022. CredScan writes its results to CSV, which is the format DefectDojo imports.

CredScan Integration with DefectDojo

We ran CredScan in our Azure DevOps builds to catch credentials before they reached a shared branch, and DefectDojo is where those detections turned into tracked cleanup work. A leaked credential isn't fixed when the line is deleted. It needs to be rotated, and someone needs to confirm that happened. Importing CredScan CSV into DefectDojo gives every detection an owner, a status, and a history on the Asset that owns the repository, so we can show which secrets were handled and which are still waiting.

Why CredScan Matters

Hard-coded credentials remain one of the simplest ways for an attacker to move from source access to production access.

• CredScan looks at configuration and build artifacts as well as code, which is where connection strings and service account passwords tend to hide.
• Each detection names the searcher that matched, the file, and the line, so the owning team can find it quickly.
• Results include a matching score, which gives reviewers a sense of how confident the match is.
• The CSV can carry suppression status and justification, so intentional test values can be documented instead of debated on every run.
• For organizations with existing CredScan output or pipelines that still produce it, the remaining question is tracking, and that is where DefectDojo helps.

Advantages of This Integration

What we gained by importing CredScan results into DefectDojo:

• One finding per secret location. Rows with the same searcher, file, and line are merged into one Finding with an occurrence count, so repeated matches don't inflate the backlog.
• Remediation tracking for rotation. Findings can be assigned to the repository owner, annotated with notes about rotation, and closed only when the work is done.
• Lifecycle on reimport. Reimporting a new CSV into the same Test mitigates detections that are gone and adds new ones.
• No secret values stored. The parser imports the searcher, location, and description text. The HashKey column is not imported, and without CredScan's triage mode the Description column holds a placeholder rather than match details.
• Context with other findings. Secret detections sit on the same Asset as SAST and SCA results, so one report covers the repository.

How This Integration Works

DefectDojo imports CredScan output with the CredScan Scan scan type.

1. Produce the CSV. Configure CredScan to write CSV output from your build. The parser expects CredScan's columns:

• Searcher, Source, and Line (required for every row).
• Description, TimeofDiscovery, IsSuppressed, SuppressJustification, and MatchingScore (used when present).

Files saved with a UTF-8 byte order mark are handled.

2. Import it. In the UI, open the Engagement, choose Import Scan Results, select CredScan Scan, and upload the CSV. To automate it, use the import API, available in Community Edition and DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=CredScan Scan" \
  -F "file=@credscan-results.csv" \
  -F "product_name=billing-service" \
  -F "engagement_name=Secrets" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "CredScan Scan" \
  --report-path "./credscan-results.csv" \
  --product-name "billing-service" \
  --engagement-name "Secrets" \
  --auto-create-context

3. Reimport on each build. Send later results to /api/v2/reimport-scan/ for the same Test so removed credentials are mitigated and history is kept.

Data Granularity: What Gets Imported

CWE, mitigation, and references are not set. Suppressed rows are imported like any other row, with the suppression noted only in the description.

Use Cases

Cleaning up a repository with history: The first CredScan run on an older codebase often finds dozens of credentials in config files. Importing them into DefectDojo lets the security team assign each to an owner, track rotation in notes, and report progress weekly.

In an Azure DevOps build: Build pipelines that produce CredScan CSV import it into a Test per repository. New detections show up as new findings after each run, and the team can push the urgent ones to Jira from DefectDojo.

During an incident review: When a credential is suspected of exposure, DefectDojo shows when it was first detected, in which file, and who was assigned, which helps establish a timeline.

Retaining evidence after migration: Teams moving from CredScan to another secret scanner import their final CredScan results so open items and their history carry over to the new process.

Operational Tips

• Set severity during triage. Every CredScan finding arrives as Info, so SLAs and dashboards treat them as low priority until someone raises the severity. Agree on a default (for example High for production passwords and private keys) before the first import.
• Don't use minimum_severity above Info for this scan type, or every finding will be filtered out.
• Suppressed rows are not marked as false positives or inactive. Mark them in DefectDojo with a note that references the CredScan justification, or exclude suppressed rows before import.
• Treat closure as rotation, not deletion. Add a note confirming the credential was rotated before marking a finding mitigated by hand.
• Keep repository paths consistent between runs. File path and line are part of the default hashcode, so changing the checkout path changes how findings match.
• Because the MSCA extension is retired, plan where secret scanning will come from next and keep the CredScan history in DefectDojo during the transition.