Whispers Integration with DefectDojo

Whispers Integration with DefectDojo

Whispers is an open source static analysis tool that finds hardcoded secrets and other sensitive values in structured text and source code. It parses formats such as JSON, YAML, and XML rather than relying only on pattern matching, which lets it understand keys and values in configuration files, and with the -a option it also scans static code in languages including Python, PHP, Java, JavaScript, and Go. Whispers is developed on GitHub under adeptex/whispers and released under the BSD 3-Clause license. It writes its results as JSON, which DefectDojo imports.

Whispers Integration with DefectDojo

Leaked credentials in config files are one of the fastest ways to lose control of a system, and Whispers is good at finding them because it reads configuration the way an application does. We run it against our repositories and deployment manifests and import the results into DefectDojo. Each hardcoded secret becomes a Finding with the file and line, a masked preview of the value, and the remediation steps for rotating it. The owning team gets an SLA, and once the secret is moved out of the file, the next reimport closes the Finding.

Why Whispers Matters

Secrets end up in configuration files, Helm values, CI definitions, and properties files far more often than in application code, and generic regex scanners miss many of them or flag too much.

• Structured parsing means Whispers knows a value belongs to a key such as a password or token field, which cuts down on false positives.
• It covers many file types used in infrastructure and deployment, not just source code.
• Its rules carry a severity, so a private key and a low-risk identifier don't look the same.
• It runs locally and in CI, so secrets can be caught before they reach a shared branch.
• Finding a secret is only half the job. Without tracking, nobody knows whether it was rotated, removed, or forgotten.

Advantages of This Integration

What we gained by routing Whispers results through DefectDojo:

• Precise location. Every Finding carries the file path and line number, so the engineer goes straight to the right place.
• Values masked on import. The description shows only the first four characters of a secret (or none, for very short values), so DefectDojo doesn't become a second copy of your credentials.
• Consistent classification. Every Whispers Finding is tagged CWE-798 (Use of Hard-coded Credentials) with a reference link and standard rotation guidance.
• Rotation tracking. Reimporting into the same Test mitigates secrets that were removed from the code and reactivates any that are reintroduced.
• SLAs on exposure. Whispers severities map to DefectDojo's scale, so a critical secret gets the deadline your policy sets for critical issues.

How This Integration Works

DefectDojo imports Whispers results with the Whispers Scan scan type. The parser reads a JSON array of results, each with key, value, file, line, message, and severity.

1. Run Whispers and write JSON. Point it at a directory or file and write the results with -o:

whispers ./my-service -o whispers.json

Add -a if you also want static code analysis. Whispers can also read a custom configuration file to adjust rules and exclusions.

2. Import the results. In the UI, open the Engagement, choose Import Scan Results, select Whispers Scan, and upload the file. From CI using the API (Community Edition and DefectDojo Pro):

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Whispers Scan" \
  -F "file=@whispers.json" \
  -F "product_name=billing-service" \
  -F "engagement_name=CI" \
  -F "auto_create_context=true"

DefectDojo Pro users can use Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Whispers Scan" \
  --report-path "./whispers.json" \
  --product-name "billing-service" \
  --engagement-name "CI" \
  --auto-create-context

3. Reimport on each commit or nightly. Send each new result to /api/v2/reimport-scan/ for the same Test so removed secrets are mitigated rather than lingering as open Findings.

Data Granularity: What Gets Imported

Unrecognized severity values become Info. Whispers' rule_id field is not mapped separately; the rule message is stored instead.

Use Cases

In pull request pipelines: A CI job runs Whispers on every merge to the main branch and reimports into the repository's Test. A newly committed credential shows up as a Finding the same day, assigned to the team that owns the repository.

For infrastructure repositories: A platform team scans Kubernetes manifests, Helm values, and other YAML and JSON configuration, where structured parsing matters most, and tracks every hardcoded value until it moves to a secrets manager.

During a secrets cleanup project: Security imports a first scan across all repositories into one Asset per repository, sets SLAs by severity, and reports weekly on how many hardcoded secrets remain.

Alongside other secret scanners: Whispers results sit on the same Asset as findings from other secrets or SAST tools, so overlaps are visible and coverage gaps stand out.

Operational Tips

• Rotate first, then remove. Deleting a secret from the file closes the Finding on reimport, but the old value is still in version control history and must be invalidated.
• Know your Whispers version. Whispers 2.1 labels map one step lower for CRITICAL (to High), while 2.2 and later map directly, so a version upgrade can shift severities and SLA deadlines.
• Deduplication depends on the line number. Adding lines above a secret moves it, which can make the same secret look new after a reimport.
• The masked preview still exposes up to four characters. Restrict access to the Asset for repositories that hold production configuration.
• DefectDojo's default hashcode settings list these fields under the key Whispers, while the parser's scan type is Whispers Scan. If you run Community Edition and see unexpected duplicates, check your instance's hashcode configuration for that scan type.
• Use Whispers' own configuration to exclude test fixtures and example files, and risk-accept intentional placeholders in DefectDojo so they stop reopening.