Pipeline task 'MicrosoftSecurityDevOps@1' fails to detect the Secrets/passwords in Python files.

Open
#51 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
25/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Stale
Tech stack
azure, typescript
Domain
devops, security

Research direction

No source file, test, or entry point is named. Start by reproducing the MicrosoftSecurityDevOps@1 pipeline scan against a Python file containing a secret, then investigate the task's documented suppression-file options. Done means the Python secret is detected and the suppression behavior is confirmed or clearly documented.

Written by the indexing model from the issue text.

Description

Previously when using the Microsoft Security Code Analysis (MSCA) extension for Cred Scan it fails to detect the passwords in Python (*.py) files, so we planned to migrate the MicrosoftSecurityDevOps extension but it still fails to detect the password in Python files.

image

Also is there any option to specify the suppressions file path which was available in Microsoft Security Code Analysis (MSCA)?

Looking forward for your suggestions.

Dominant language
TypeScript
Stars
86
Forks
22
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from microsoft/security-devops-azdevops

All issues in microsoft/security-devops-azdevops

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.