How can I address false positives being detected with atlassian/git-secrets-scan?

Question

I have a repository with variious shell scripts. One of those scripts sets some standard variables, but it's getting flagged "found security credentials" but what it's flagging is not credentials.

How can I address these false positives so that the check doesn't not fail erroneously?

Thanks!

Igor Stoyanov · Answer

@Daniel Carrington hi.
Maybe you could split your file to two files, first file will contain only variables that should be ignored and you will exclude it from scan, and the second file will contain all other standard variables that you will scan.

Regards, Igor

Daniel Carrington · Answer

Well...that's a bummer. I'd still like the file to be part of the check, but I guess that won't be posslble.

Thanks!

Aron Gombas _Midori_ · Answer

You can find the documentation here: https://bitbucket.org/atlassian/git-secrets-scan/src/master/

You can include/exclude files.

Because you can't customize the built-in pattern, only add new custom patterns, exclude the with false positives seems to be the only tool to address your problem. Unfortunately, it also means that the leaked secrets in that file will not found, either.