Skip to content

Enhancement to Secret Scanner: Detection of Hardcoded Secrets in App's Manifest - #78

Merged
jwong101 merged 9 commits into
atlassian-labs:mainfrom
snarayan2-atlas:eas-3876-manifest-secrets
Jan 23, 2026
Merged

Enhancement to Secret Scanner: Detection of Hardcoded Secrets in App's Manifest#78
jwong101 merged 9 commits into
atlassian-labs:mainfrom
snarayan2-atlas:eas-3876-manifest-secrets

Conversation

@snarayan2-atlas

Copy link
Copy Markdown
Contributor

Summary: Addition to FSRT's Secret Scanner to detect when there are hardcoded secrets in an App's manifest.yml in OAuth Providers.

Changes Made:

  • Added data structures and serde deserialization for the parsing of the providers section in the manifest
  • Added secret detection logic. Main locations searched for are: authorization.queryParameters,
  • exchange.overrides.headers, and exchange.overrides.body. More info on this: https://hello.atlassian.net/wiki/x/1asSawE.
  • Integrated with the existing Secret Scanner and vulnerability reports
  • Added unit and integration testing

@snarayan2-atlas snarayan2-atlas changed the title Eas 3876 manifest secrets Enhancement to Secret Scanner: Detection of Hardcoded Secrets in App's Manifest Nov 17, 2025
Comment thread crates/forge_loader/src/manifest.rs Outdated
Comment thread crates/forge_loader/src/manifest.rs
Comment thread crates/forge_analyzer/src/checkers.rs Outdated
Comment thread crates/forge_loader/src/manifest.rs Outdated
Comment thread crates/forge_loader/src/manifest.rs Outdated
@jwong101
jwong101 merged commit 81a396b into atlassian-labs:main Jan 23, 2026
4 checks passed
gabejgladstone pushed a commit to gabejgladstone/FSRT that referenced this pull request Apr 3, 2026
…nifest-secrets

Enhancement to Secret Scanner: Detection of Hardcoded Secrets in App's Manifest
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants