Request: using a baseline as an allowlist about detect-secrets HOT 5 CLOSED

Hi @jamesbraza 👋🏼 thanks for opening this issue! How would you envision this allowlist?

from detect-secrets.

Thanks for asking! To be more concise, the idea of the allowlist is going from many # pragma: allowlist secret comments in my code base to just 1 entry in an allowlist file.

I think a YAML or TOML config file is fine, where allowed secrets show up in a YAML list. Open to anything really, and ideally it plays nicely with detect-secrets scan --baseline .secrets.baseline

from detect-secrets.

@jamesbraza I think the existing --exclude-secrets option is what you're looking for. There's a corresponding setting you can put in your baseline file.

from detect-secrets.

You are correct! It ends up in the baseline looking like this:

    {
      "path": "detect_secrets.filters.regex.should_exclude_secret",
      "pattern": [
        "abc123",
        "def456",
        "test_value"
      ]
    }

That being said, I ended up going with the word_list extra and invoking like so:

detect-secrets scan --word-list=.secrets.allowlist

Going to close this out, thank you both!

from detect-secrets.

No worries, glad we could help out! @gpflaum thanks for helping out :)

from detect-secrets.