Nosey Parker
Input Type:
This parser takes JSON Lines Output from Nosey Parker: https://github.com/praetorian-inc/noseyparkerSupports
Supports version 0.16.0: https://github.com/praetorian-inc/noseyparker/releases/tag/v0.16.0
Things to note about the Nosey Parker Parser:
- All findings are marked with a severity of ‘High’
- The deduplication algorithm marks a unique finding by the secret, filepath, and line number all together
- The Nosey Parker tool allows for both full history scans of a repo and targeted branch scans
The Parser does NOT differentiate between the 2 scan types (may be future functionality)
For full history scans:
- The scan will pick up secrets committed in the past that have since been removed
- If a secret is removed from source code, it will still show up in the next scan
- When importing findings via the Dojo API, make sure to use the parameter
do_not_reactivate
which will keep existing findings closed, without reactivating them
For targeted branch scans:
- Keep in mind there may be active secrets that are either in the git history or not in the current branch
JSON Lines Format:
The parser only accepts .jsonl reports. Each line of the JSON Lines file from NoseyParker corresponds to a unique secret found with metadata for every match.
Sample Scan Data
Sample scan data for testing purposes can be found here.
Last modified February 27, 2024: Nosey Parker Parser (#9067) (18ff583c2)