Checkov Secrets Framework Scanning exposes secrets in junit test output

[GrahamGoldENG]

We have recently starting using checkov scans in our CI/CD pipelines and have a less than stellar experience.

First the positives:

• It is very good at finding secrets!

Now the negative...

• When a secret is found, the secret is included in the junit output (stacktrace) in plaintext, unmasked

This therefore means secrets perfectly visible in our Azure DevOps pipelines Tests output.

We raised a TAC and the advise was to raise a feature/enhancement request - which we have done here Checkov should mask secrets | Prisma Cloud New Features Request Portal (aha.io)

However, as votes are normalised by customer, 1 vote from us vs 100 votes from us is still 1 vote - so if you also think this is bad and that our enhancement request should be prioritised, please upvote the above linked Feature Request.

Thanks,

Graham

[JayGolf]

Hi @GrahamGoldENG ,

I would also recommend posting to the General Topics area. This could increase visibility with a wider range of users.