Scanning rules and scope
The 17 categories, your own patterns, what to scan, and which projects to skip.
What this page is for. Controlling what counts as a finding. Getting this right is the difference between a queue your team works and a queue your team ignores.
The app ships 165 detection patterns in 17 categories. You can switch off a whole category, switch off individual rules, and add patterns of your own.
Jira → Apps → Secret Scanner → Scanning RulesIllustration
Scanning Rules
FindingsDismissedBulk ScanAnalyticsScanning RulesProject ExclusionsSettingsAudit Log
Secret & PII Scanner
Scanning scope
Scan Issue Changelog
Scan Attachments — text-based files up to 1 MB (.txt, .json, .yaml, .env…)
Remediation
Auto-Redaction
Auto-redaction permanently modifies issue content. Secrets will be replaced with
[REDACTED].Require Reason When Dismissing
Pattern Categories
Search rules by name...
| Category | Patterns | Covers | Enabled |
|---|---|---|---|
| Cloud Providers | 17 | AWS, GCP, Azure, Firebase and Supabase credentials | |
| AI & ML Services | 9 | OpenAI, Anthropic, HuggingFace, Groq, xAI, Perplexity keys | |
| Source Control & CI/CD | 17 | GitHub, GitLab, Bitbucket, Terraform Cloud, CircleCI, Docker Hub | |
| Private Keys & Certificates | 5 | PEM, PGP, PuTTY, AGE keys | |
| PII — Financial | 8 | Visa, Mastercard, Amex, Discover, JCB card numbers, IBAN | |
| PII — Contact & Network | 3 | IPv4, MAC addresses, phone numbers |
Custom Regex Patterns
Pattern Name
Internal API Key
Regex Pattern
MYCO-[A-Za-z0-9]{32}
Test String (optional)
key=MYCO-8f2b41d09c7e4a15b6d3e0f7a9c25813
Add PatternSave Patterns
The 17 categories
| Category | Patterns | What it detects |
|---|---|---|
| Cloud Providers | 17 | AWS, GCP, Azure, Firebase and Supabase credentials |
| AI & ML Services | 9 | OpenAI, Anthropic, HuggingFace, OpenRouter, Groq, xAI, Perplexity keys |
| Source Control & CI/CD | 17 | GitHub, GitLab, Bitbucket, Terraform Cloud, CircleCI, Docker Hub, SonarQube |
| Communication Platforms | 9 | Slack, Discord, Telegram and Teams tokens and webhooks |
| Payment Processors | 11 | Stripe, Square, Shopify, Plaid, Braintree |
| Email & SMS Services | 7 | SendGrid, Mailchimp, Mailgun, Twilio, Brevo |
| Observability & Monitoring | 10 | New Relic, Grafana, Dynatrace, Sentry, Datadog |
| Infrastructure & DevOps | 13 | Vault, Heroku, DigitalOcean, Cloudflare, Doppler, Pulumi, Databricks, Fly.io |
| Package Registries | 8 | npm, PyPI, RubyGems, Clojars, JFrog, crates.io, NuGet |
| Database Connections | 8 | MongoDB, PostgreSQL, MySQL, Redis, Snowflake, RabbitMQ connection strings |
| Tokens & Auth Standards | 3 | JWT, Bearer tokens, Basic Auth headers |
| Private Keys & Certificates | 5 | PEM, PGP, PuTTY and AGE private keys, X.509 certificates |
| PII — Personal Identification | 8 | CPF, CNPJ, RG, PIS/PASEP, SSN, ITIN |
| PII — Financial | 8 | Visa, Mastercard, Amex, Discover, Diners Club, JCB card numbers, IBAN |
| PII — Contact & Network | 3 | IP addresses, MAC addresses, phone numbers |
| Generic Keyword Secrets | 4 | password= style assignments, secret variables, environment secrets |
| Miscellaneous Services | 25 | Atlassian, Okta, 1Password, Notion, Linear, Postman, Figma, HubSpot and others |
Switch these two off first if the queue is too noisy
PII — Contact & Network matches every IP address and phone number, which in an operations project means most tickets. Generic Keyword Secrets matches
password= anywhere, including in sample code and documentation. Both are valuable in some instances and pure noise in others. Decide per category, not per finding.Adding your own patterns
Internal credentials have internal shapes, and no shipped pattern will know them. Under Custom Regex Patterns you give the pattern a name and a regular expression, and you can paste a sample string to check it matches before saving. There is no limit on how many you add.
- Anchor it to a distinctive prefix.
MYCO-[A-Za-z0-9]{32}finds your keys. A bare[A-Za-z0-9]{32}finds every long word in your instance. - Test with a real sample and a near-miss. The test box exists so you can confirm both.
- Name it after the credential. That name appears on the finding, and it tells the responder what to rotate.
Scanning scope and remediation settings
Jira → Apps → Secret Scanner → Settings → Issue CreationIllustration
Secret & PII Scanner
FindingsDismissedBulk ScanAnalyticsScanning RulesProject ExclusionsSettingsAudit Log
← Back
Remediation Tracking
Where a ticket is filed when you raise one from a finding.
Tracking project
Security (SEC)
Issue Type
Task
Priority
Highest
Create the tracking ticket automatically when a new finding is detected
Save| Setting | What it does | What we recommend |
|---|---|---|
| Scan Attachments | Reads text-based attachments up to 1 MB: .txt, .json, .yaml, .env and similar. Binary files are never read. | On. Config files are where the worst findings live. |
| Scan change history | Covers values that were pasted and later edited out. | On. The changelog keeps them, so your scanning should too. |
| Auto-Redaction | Replaces every occurrence with [REDACTED] in the summary, description, comments and text custom fields. It permanently changes issue content, the edit is made by the app rather than by you, and it never touches change history or attachments — a secret in the changelog can only be removed by deleting the issue. | Off at first. Turn it on only once you trust your pattern set. |
| Require Reason When Dismissing | Forces a reason on every dismissal. | On if anyone will audit this. It costs the person five seconds. |
| Secret & PII Scanner (the master switch) | At the top of Scanning Rules. Off means nothing is scanned at all — no events, no bulk scans. | On, which is how it ships. Use the categories to narrow the scope rather than this switch, unless you genuinely need to stop everything. |
| Tracking project / Issue Type / Priority | On the Settings tab, under Issue Creation. Where Create Issue files remediation tickets, and at what priority. | A dedicated security project. Priority defaults to the highest your site has. |
| Create the tracking ticket automatically | A checkbox in the same card. Raises the remediation ticket the moment a finding is detected, without anybody clicking anything. | Off until the findings have proven accurate. On a noisy pattern set it fills a project with tickets faster than anyone can close them. |
Project exclusions
Some projects legitimately contain credential-shaped text: a sandbox, a training project, documentation examples. List them under Project Exclusions and the scanner skips them silently.
Do this rather than letting your team learn to ignore findings. A queue with known-fake entries in it stops being read.