Analyzers
Secrets
Analyzers
Secrets
Hardcoding credentials in code is never a good idea. If your source code falls into the hands of a malicious entity (and it happens more often than we’d like to acknowledge), they can use secrets from the source code to gain access to systems.
This section covers configuration specific to the Secrets analyzer. Please make sure you have read the general configuration guide first.
Configuration - .deepsource.toml
name
- Type: String
- Presence: mandatory
- Description: Shortcode of the analyzer.
- Example:
enabled
- Type: Boolean
- Presence: optional
- Description: Toggle whether this analyzer should be run.
- Example:
The Secrets analyzer only detects hardcoded secrets in non-test files. To specify a certain pattern of files as test files, add them as test patterns, as shown in the example below.