Getting Started

Introduction

SCAN (Sensitive Code Analyzer for Nerds) is a powerful Gradle plugin designed to automatically detect secrets, API keys, and other sensitive information in your codebase. It integrates seamlessly into your build process and helps prevent accidental exposure of sensitive data.

Requirements

Before installing SCAN, ensure your environment meets these requirements:

You can check your current versions:

# Check Java version
java -version

# Check Gradle version
gradle --version

# Or using Gradle wrapper
./gradlew --version

Installation

Add the SCAN plugin to your build.gradle.kts or build.gradle file:

Kotlin DSL (build.gradle.kts)

plugins {
    id("io.github.theaniketraj.scan") version "2.0.0"
}

Groovy DSL (build.gradle)

plugins {
    id 'io.github.theaniketraj.scan' version '2.0.0'
}

Legacy Plugin Application

If you're using an older Gradle version, you can use the legacy plugin syntax:

buildscript {
    repositories {
        gradlePluginPortal()
    }
    dependencies {
        classpath "io.github.theaniketraj:scan-gradle-plugin:2.0.0"
    }
}

apply plugin: "io.github.theaniketraj.scan"

First Scan

Once the plugin is installed, you can run your first security scan:

# Run a basic scan
./gradlew scanForSecrets

# Run with verbose output
./gradlew scanForSecrets --info

# Run with debug information
./gradlew scanForSecrets --debug

The scan will:

• 🔍 Analyze all source files in your project
• 🎯 Apply built-in patterns to detect common secrets
• 📝 Generate a detailed report
• ⚠️ Display findings in the console

Understanding the Output

A typical scan output looks like this:

> Task :scanForSecrets
Starting security scan...
Scanning 127 files...

🔍 SCAN Results:
┌─────────────────────────────────────────────────┐
│ Found 2 potential secrets in 1 file(s)          │
├─────────────────────────────────────────────────┤
│ File: src/main/java/Config.java                 │
│ Line: 15                                        │
│ Type: API Key                                   │
│ Match: sk_test_51H...                           │
├─────────────────────────────────────────────────┤
│ File: src/main/java/Config.java                 │
│ Line: 23                                        │
│ Type: Database Password                         │
│ Match: password=secret123                       │
└─────────────────────────────────────────────────┘

BUILD FAILED

Basic Configuration

Customize SCAN's behavior by adding a configuration block to your build file:

Essential Configuration

scan {
    // Fail the build when secrets are detected
    failOnDetection = true
    
    // Choose output format: "console", "json", "html"
    reportFormat = "console"
    
    // Specify output directory
    outputDir = "scan-results"
    
    // Set scan sensitivity: "low", "medium", "high"
    sensitivity = "medium"
}

Advanced Configuration

scan {
    failOnDetection = true
    reportFormat = "json"
    outputDir = "security-reports"
    
    // Exclude specific files or directories
    excludePaths = [
        "**/test/**",
        "**/build/**",
        "**/*.min.js"
    ]
    
    // Include only specific file types
    includePaths = [
        "**/*.java",
        "**/*.kt",
        "**/*.properties"
    ]
    
    // Custom patterns file
    customPatternsFile = "config/custom-patterns.yml"
    
    // Enable parallel processing
    parallel = true
    
    // Set maximum file size (in MB)
    maxFileSize = 10
}

Understanding Results

SCAN provides detailed information about detected secrets to help you understand and address security issues.

Result Components

Report Formats

Choose the format that best suits your workflow:

• Console: Human-readable output for development
• JSON: Machine-readable for CI/CD integration
• HTML: Detailed web-based report with navigation

Next Steps

Now that you have SCAN running, explore these topics to get the most out of the plugin: