FAQ

What kind of secret type patterns does the app detect?

A list of secret type patterns that No More Secrets uses to detect secrets:

During the “allow access” process, there is a list of permission scopes that I need to allow access for. Are all of these necessary?

Atlassian has recently changed how app permissions work, requiring apps to request more detailed permission scopes for the data they have access to.

Why is each of these permission scopes required?

In Jira

• Delete

  • Delete issue properties. No More Secrets uses issue properties for storing attachment scan results – these scan results are deleted when an attachment is removed from the issue.

• View

  • View various fields and data related to Jira issues. No More Secrets scans text-based field values and comments in Jira issues. To do this, the app requests issue data. Not all of the data are used by No More Secrets, but Jira requires all of these granular scopes enabled to be able to fetch any issue data.

  • View issue properties. These permissions are required for the storage and retrieval of attachment scan results.

  • View attachment permission is required for the upcoming attachment content scanning feature.

  • View all projects with issue search for the project scanner

• Update

  • Create and update issue properties. No More Secrets uses issue properties for storing attachment scan results. The app updates these scan results if the patterns used for secret detection change.

• Send

  • Send email notifications when a new issue or new comment is created that includes potential secrets.

In User

• View the currently logged in user. This is a general permission required for user-facing apps, and is necessary for the app’s “custom field” component.

Who gets email notifications about detected secrets?

When a new issue is created that includes secrets, the reporter of the issue will receive an email notification.

Also, when a new comment that includes a secrets is added to an issue, the author of the comment will receive an email notification.

Finally, when an attachment that includes secrets is added to an issue, the author of that addition will receive an email notification.

Why am I not receiving email notifications about detected secrets?

Check personal settings (Click on Avatar > Jira Personal Settings) to ensure “Send me email notifications” is enabled and choose the email notification notifications format of preference.

Also, check that the project itself has the project role atlassian-addons-project-access included in each of the project permissions

What is the max attachment file size that the app can scan for secrets?

The app can scan attachments up to and including file sizes of 25 MB

Which attachment file types are scanned for secrets within their content?

The app can scan the contents of text type file attachments. All other file types will be excluded from attachment content secret scanning.

Why is the custom field not visible for my team-managed project?

Atlassian currently only supports the custom fields to be available for company-managed & service management projects. However, if secrets are added to team-managed project issues, the reporter of the issue will be notified that secrets have been detected in the issue. The same applies if new comments or attachments with secrets are added to existing issues, the author of those additions will be notified with an email.

Does No More Secrets for Jira need special project permissions?

The app requires the atlassian-addons-project-access project role to have permission to all projects that need to be scanned for secrets. To check if this project role is included, go to Project Settings > Permissions.

Note: For the automated scanning of new attachments (and sending email notifications), this permission is used by the app. For the No More Secrets Project Scanner, the logged-in user conducting the scan must have access to the project(s). Only projects the user has permission to access will return issue scan results.