Detect-secrets Integration with DefectDojo

Detect-secrets Integration with DefectDojo

Detect-secrets is an open source secrets scanner created by Yelp and published on GitHub. It scans a code base with a set of plugins, including detectors for AWS keys, private keys, Slack and Stripe tokens, basic auth strings, keyword assignments, and high-entropy strings, and records what it finds in a JSON "baseline" file. Teams typically run it as a pre-commit hook and in CI, and use its audit mode to label each detected string as a real secret or a false positive. DefectDojo imports that baseline JSON. Despite the "GitHub" label sometimes attached to it, detect-secrets is a Yelp project and not a GitHub product.

Detect-secrets Integration with DefectDojo

We use detect-secrets because its baseline model fits how we work: it tolerates the strings already in the repository and blocks anything new. What it doesn't do is tell anyone outside the repository that a credential is sitting in the code. Importing the detect-secrets baseline into DefectDojo turns each detected secret into a High severity Finding on the Asset that owns the repository, carries over the audit decisions developers already made, and gives the security team a list of credentials to rotate with owners and due dates.

Why Detect-secrets Matters

A hardcoded credential is one of the shortest paths from a leaked repository to a breach. Detect-secrets is cheap to adopt and fits into existing developer workflows.

• The baseline file stores a hash of each secret, not the secret itself, so the report is safe to pass around and import.
• Audit mode lets the people who know the code mark each result as a real secret or not, and the baseline remembers the decision.
• Its plugin set covers common cloud and SaaS token formats plus generic entropy and keyword checks.
• Without central tracking, the baseline answers "what was found" but not "has anyone rotated it," and each repository keeps its own isolated list.

Advantages of This Integration

What we gained by importing detect-secrets results into DefectDojo:

• Audit decisions carry over. Results audited as real secrets import as active, results audited as not secret import as false positives, and unaudited results import as active so they are not missed.
• Verified secrets stand out. The is_verified flag from the baseline maps to DefectDojo's verified field.
• Consistent priority. Every detected secret imports as High severity with CWE-798 (Use of Hard-coded Credentials), so secrets fall under one SLA rule.
• Deduplication across runs. DefectDojo hashes each finding on title, CWE, line, file path, and description, and the parser collapses repeated entries for the same secret, type, file, and line within one report.
• Ownership and lifecycle. Each finding can be assigned, annotated with rotation notes, pushed to Jira, and closed by reimport once the secret is removed from the code.

How This Integration Works

DefectDojo imports detect-secrets output with the Detect-secrets Scan scan type, which reads the baseline JSON.

1. Create or update the baseline. From the repository root:

detect-secrets scan > .secrets.baseline

2. Audit it (optional but recommended). Walk through each result and mark it as a real secret or a false positive. Detect-secrets writes the answer into the baseline as is_secret:

detect-secrets audit .secrets.baseline

3. Import the baseline. In the UI, open the Engagement, choose Import Scan Results, select Detect-secrets Scan, and upload the file. To automate, use the import API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Detect-secrets Scan" \
  -F "file=@.secrets.baseline" \
  -F "product_name=payments-api" \
  -F "engagement_name=Secrets" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Detect-secrets Scan" \
  --report-path "./.secrets.baseline" \
  --product-name "payments-api" \
  --engagement-name "Secrets" \
  --auto-create-context

4. Reimport on each change. Send later baselines to /api/v2/reimport-scan/ against the same Test. Secrets that were removed from the code, and therefore from the baseline, are mitigated in DefectDojo.

The parser reads the baseline's generated_at timestamp as the finding date, so import the baseline file as detect-secrets writes it rather than a trimmed copy of the results section.

Data Granularity: What Gets Imported

The secret value is never imported. The baseline stores only a hash, and the parser does not copy it into the finding.

Use Cases

In a CI/CD pipeline: Each merge to the main branch regenerates the baseline and reimports it. New secrets appear as new High findings on the Asset, and the security team sees them the same day instead of at the next audit.

During a secrets cleanup project: A team inherits a monorepo with hundreds of baseline entries. They audit the baseline, import it, and the true positives become a list in DefectDojo that can be split by owner and tracked to zero as credentials are rotated and removed.

For an audit trail: Each finding keeps the date it was found, its notes and status changes, and the date it closed, which answers a reviewer's question about how quickly exposed credentials were handled.

Across many repositories: Importing each repository's baseline into its own Asset gives security leads a count of open hardcoded secrets by team without collecting baselines by hand.

Operational Tips

• Audit before importing whenever you can. Unaudited results arrive active, and entropy-based detectors generate noise that is easier to label in detect-secrets than in DefectDojo.
• Severity is fixed at High. If you want leaked production credentials to outrank test fixtures, adjust severity during triage or separate test directories into their own Test.
• Line numbers move as code changes, and line is part of the hashcode. A secret that shifts lines can appear as new on reimport, so close the old one when that happens.
• Removing a secret from the code is not the fix. Rotate it first, and record the rotation in the finding's notes before it closes.
• Tag imports with the repository name (for example tags=secrets,payments-api) to filter secrets findings in metrics.
• Use minimum_severity with care here: since every finding is High, any threshold above High drops all of them.