Improve documentation of client-side secret detection
Problem to solve
Documentation of the client-side secret detection could be improved:
- The list of secrets mentioned on the main client-side SD docs page is only a subset of those in the list of Detected secrets
- Terminology is inconsistent. We have standardized on "secret", but the docs use "token" and "sensitive token".
- The list of where client-side SD can detect secrets is a little difficult to read. Also, epics' descriptions are not mentioned, so we need to confirm and document that.
- Caveats and conditions that apply to client-side SD are not documented. For example, if a user adds a comment of which they were warned contained a secret, no further warning is provided and it's not contained in the vulnerability report.
Proposal
- Simplify the list of where secrets are detected.
- It should be emphasized that a secret detected by client-side secret detection cannot be seen by anyone else until the comment/description containing it is added. Though perhaps mention that no further notification is provided after a secret is added to a comment or description.
- Note any caveats and conditions that apply to client-side SD, similarly to what's described in Docs: Standardize the introduction to patterns ... (#467847 - closed).
Who can address the issue
Anyone
Other links/references
Edited by Russell Dickenson