Ignore Secrets if not needed

Use case

FlyingDuck can detect over 150 types of secrets within the source code. In some cases, certain secrets may not be sensitive to the organization and can be ignored. You can exclude these secrets using the following three methods.

Ways to ignore

• Ignore secrets by Line
• Ignore secrets by File
• Ignore secrets by Type

Ignore secrets by Line

Description:

If you want to ignore a specific secret that is detected in the portal, then you can simply add a line just above the secret as # fd_secret_ignore. This will make sure the secret is scanned but not appeared in the portal results.

Remediation:

# fd_secret_ignore

AWS Access Key ID = AKIAIOSFODNN7EXAMPLE 

AWS Secret Access Key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

In the above scenario the AWS Access Key ID will be ignored but the AWS Secret Access Key is detected and reported.

Ignore secrets by File

Description:

If you want to ignore a complete file from being scanned for secrets, then you can specify this file in the .fdignore.yaml file and that will take care of the rest.

Remediation:

1. Create a .fdignore.yaml file in the root directory of GitHub repository.

2. Add the following lines into that file as many as needed.

secrets: 

    files: 

        - src/app/config.yaml
        - src/components/broker.js

3. If more files are needed, then add those file paths by following the above syntax.

4. If you would like to ignore a complete directory, then use regular expressions.

In this case all the file paths and directories listed in this file will be ignored by the agent for secret scanning, so that those secrets do not appear in the portal.

Ignore secrets by Type

Description:

If you want to ignore a specific secret type such as emails or usernames, then you can add those secret key names into the .fdignore.yaml file and that will skip reporting those secrets to the portal. Please refer to this for the complete list of secret names.

Remediation:

Create a .fdignore.yaml.

If it is already created, then add the following lines into that as needed.

secrets: 

    types: 

        - GITHUB_PAT

        - CIRCLECI_AT

If more secret types are to be ignored, then add them by following the above given syntax.

In this case all the mentioned secret types listed in the file will be ignored by the agent for those specific secrets and only reports the remaining secrets detected.