Checkov Secrets Framework Scanning exposes secrets in junit test output

GrahamGoldENG — Fri, 03 Nov 2023 15:48:31 GMT

We have recently starting using checkov scans in our CI/CD pipelines and have a less than stellar experience.

First the positives:

It is very good at finding secrets!

Now the negative...

When a secret is found, the secret is included in the junit output (stacktrace) in plaintext, unmasked

This therefore means secrets perfectly visible in our Azure DevOps pipelines Tests output.

We raised a TAC and the advise was to raise a feature/enhancement request - which we have done here Checkov should mask secrets | Prisma Cloud New Features Request Portal (aha.io)

However, as votes are normalised by customer, 1 vote from us vs 100 votes from us is still 1 vote - so if you also think this is bad and that our enhancement request should be prioritised, please upvote the above linked Feature Request.

Thanks,

Graham

Re: Checkov Secrets Framework Scanning exposes secrets in junit test output

JayGolf — Wed, 08 Nov 2023 04:32:52 GMT

Hi @GrahamGoldENG ,

I would also recommend posting to the General Topics area. This could increase visibility with a wider range of users.

topic Checkov Secrets Framework Scanning exposes secrets in junit test output in Prisma Cloud Discussions

Checkov Secrets Framework Scanning exposes secrets in junit test output

Re: Checkov Secrets Framework Scanning exposes secrets in junit test output