Commit e0cc5d24 authored by Fabio Busatto's avatar Fabio Busatto Committed by Achilleas Pipinellis

Improve docs for Secret Detection

parent 06b674f9
......@@ -35,7 +35,6 @@ The following languages and frameworks are supported.
| Language / framework | Scan tool |
| .NET | [Security Code Scan]( |
| Any | [Gitleaks](, [TruffleHog]( and [Diffence]( (secret detectors) |
| C/C++ | [Flawfinder]( |
| Go | [Gosec]( |
| Groovy (Ant, Gradle, Maven and SBT) | [find-sec-bugs]( |
......@@ -48,6 +47,17 @@ The following languages and frameworks are supported.
| Scala (Ant, Gradle, Maven and SBT) | [find-sec-bugs]( |
| Typescript | [TSLint Config Security]( |
## Secret Detection
GitLab is also able to detect secrets and credentials that have been unintentionally pushed to the repository.
For example, an API key that allows write access to third-party deployment environments.
This check is performed by a specific analyzer during the `sast` job. It runs regardless of the programming
language of your app, and you don't need to change anything to your
CI/CD configuration file to turn it on. Results are available in the SAST report.
GitLab currently includes [Gitleaks](, [TruffleHog](, and [Diffence](
## How it works
First of all, you need to define a job in your `.gitlab-ci.yml` file that generates the
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment