Nosey Parker Integration with DefectDojo
Nosey Parker is an open-source command-line secrets scanner developed by Praetorian that combines regular expression-based pattern matching with machine learning techniques to detect hardcoded secrets including API keys, passwords, tokens, cryptographic keys, and credentials within textual data, files, directories, and complete Git repository histories with high accuracy and minimal false positives. The tool provides exceptional performance with scanning speeds of hundreds of megabytes per second, efficient deduplication that reduces review workload by over 100x, and 146 carefully curated detection rules optimized through offensive security engagements, enabling security professionals, penetration testers, and developers to proactively identify and remediate exposed secrets before they can be exploited by attackers.
Data Granularity: What Gets Imported
The following fields are captured from Nosey Parker results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "Nosey Parker",
"engagement": "<engagement-id>",
"file": "results.json"
}