Answers: <p>I resolved the issue by adding a comment containing <code>pragma: allowlist secret</code> in the offending line.</p>
  <p>I didn't try it at first, because the issue was in an <code>appsettings.json</code> file of an asp.net project and according to Google json can't have comments. However, seems like Microsoft does allow <code>//</code> comments in <code>appsettings.json</code>.</p>
  
Answers: CC BY-SA 4.0
Answers: 2024-03-14T07:56:37.720Z
Answers: 2024-03-14T07:56:37.720Z
Answers: Louis Cloete
Body: <p>detect-secrets-hook in my pre-commit is alerting on secrets that are already marked as safe to be committed in the baseline.</p>
  <p>I'm running detect-secrets version 1.4.0 on Python 3.11.0 on Windows 11.</p>
  <p>To reproduce:</p>
  <ol>
  <li>Have a file in a git repo containing something that will get caught as a secret. Update something in the file so that it needs to be committed.</li>
  <li>Create/recreate a secrets baseline with <code>detect-secrets scan &gt; .secrets.baseline</code></li>
  <li>Resave the baseline file as UTF-8, <a href="https://github.com/Yelp/detect-secrets/issues/272" rel="nofollow noreferrer">because I'm on Windows</a>.</li>
  <li>Run <code>detect-secrets audit .secrets.baseline</code> and accept that the secret is okay to be in the file. The segment of the baseline file looks like:</li>
  </ol>
  <pre><code>&quot;results&quot;: {
      &quot;xyz\\dev_local_settings.py&quot;: [
        {
          &quot;type&quot;: &quot;Secret Keyword&quot;,
          &quot;filename&quot;: &quot;xyz\\dev_local_settings.py&quot;,
          &quot;hashed_secret&quot;: &quot;62f4d1d18d106c8e6f3c79df832893f4b6e95c8e&quot;,
          &quot;is_verified&quot;: false,
          &quot;line_number&quot;: 26,
          &quot;is_secret&quot;: false
        }
      ]
    },
  </code></pre>
  <ol start="5">
  <li>Have a pre-commit config that looks like this:</li>
  </ol>
  <pre><code>repos:
  -   repo: https://github.com/Yelp/detect-secrets
      rev: v1.4.0
      hooks:
      -   id: detect-secrets
          args: ['--baseline', '.secrets.baseline']
          exclude: package.lock.json
  </code></pre>
  <ol start="6">
  <li>Attempt to <code>git commit -a</code>.</li>
  </ol>
  <p>The pre-commit check will fail on the one known secret:</p>
  <pre><code>Detect secrets...........................................................Failed
  - hook id: detect-secrets
  - exit code: 1
  
  ERROR: Potential secrets about to be committed to git repo!
  
  
  Secret Type: Secret Keyword
  Location:    xyz/dev_local_settings.py:26
  </code></pre>
  <ol start="7">
  <li>Another run of <code>detect-secrets audit .secrets.baseline</code> yields &quot;Nothing to audit!&quot;</li>
  </ol>
  <p>Am I misunderstanding how detect-secrets works? I would expect it to not alert on a secret that was marked as safe in the baseline.</p>
  
Comments: CC BY-SA 4.0
Comments: 2024-03-13T07:42:35.407Z
Comments: did you resolve your issue? I'm having the exact same issue.
Comments: Louis Cloete
Tags: <security><devsecops>
Title: Why is detect-secrets-hook ignoring my audit selections?
UserDisplayName: Melissa Avery-Weir
ThreadText: # Why is detect-secrets-hook ignoring my audit selections?
  
  (Asked by: username_0 on 2023-04-16)
  
  detect-secrets-hook in my pre-commit is alerting on secrets that are already marked as safe to be committed in the baseline.
  
  I'm running detect-secrets version 1.4.0 on Python 3.11.0 on Windows 11.
  
  To reproduce:
  
  1. Have a file in a git repo containing something that will get caught as a secret. Update something in the file so that it needs to be committed.
  2. Create/recreate a secrets baseline with `detect-secrets scan > .secrets.baseline`
  3. Resave the baseline file as UTF-8, [because I'm on Windows](https://github.com/Yelp/detect-secrets/issues/272).
  4. Run `detect-secrets audit .secrets.baseline` and accept that the secret is okay to be in the file. The segment of the baseline file looks like:
  
  ```
  "results": {
      "xyz\\dev_local_settings.py": [
        {
          "type": "Secret Keyword",
          "filename": "xyz\\dev_local_settings.py",
          "hashed_secret": "62f4d1d18d106c8e6f3c79df832893f4b6e95c8e",
          "is_verified": false,
          "line_number": 26,
          "is_secret": false
        }
      ]
    },
  
  ```
  
  5. Have a pre-commit config that looks like this:
  
  ```
  repos:
  -   repo: https://github.com/Yelp/detect-secrets
      rev: v1.4.0
      hooks:
      -   id: detect-secrets
          args: ['--baseline', '.secrets.baseline']
          exclude: package.lock.json
  
  ```
  
  6. Attempt to `git commit -a`.
  
  The pre-commit check will fail on the one known secret:
  
  ```
  Detect secrets...........................................................Failed
  - hook id: detect-secrets
  - exit code: 1
  
  ERROR: Potential secrets about to be committed to git repo!
  
  Secret Type: Secret Keyword
  Location:    xyz/dev_local_settings.py:26
  
  ```
  
  7. Another run of `detect-secrets audit .secrets.baseline` yields "Nothing to audit!"
  
  Am I misunderstanding how detect-secrets works? I would expect it to not alert on a secret that was marked as safe in the baseline.
  
  **Tags:** security, devsecops
  
  > **Comments:**
  > **username_1**: did you resolve your issue? I'm having the exact same issue.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2024-03-14. Score: 0
  
  I resolved the issue by adding a comment containing `pragma: allowlist secret` in the offending line.
  
  I didn't try it at first, because the issue was in an `appsettings.json` file of an asp.net project and according to Google json can't have comments. However, seems like Microsoft does allow `//` comments in `appsettings.json`.
  
  
  ---
  
  