# Using Homebrew -weight: 500;">brew tap hashicorp/tap -weight: 500;">brew -weight: 500;">install hashicorp/tap/vault-radar # Using Homebrew -weight: 500;">brew tap hashicorp/tap -weight: 500;">brew -weight: 500;">install hashicorp/tap/vault-radar # Using Homebrew -weight: 500;">brew tap hashicorp/tap -weight: 500;">brew -weight: 500;">install hashicorp/tap/vault-radar # Download the binary -weight: 500;">wget https://releases.hashicorp.com/vault-radar/0.10.0/vault-radar_0.10.0_linux_amd64.zip ​ # Unzip unzip vault-radar_0.10.0_linux_amd64.zip ​ # Move to PATH -weight: 600;">sudo mv vault-radar /usr/local/bin/ ​ # Make executable -weight: 600;">sudo chmod +x /usr/local/bin/vault-radar # Download the binary -weight: 500;">wget https://releases.hashicorp.com/vault-radar/0.10.0/vault-radar_0.10.0_linux_amd64.zip ​ # Unzip unzip vault-radar_0.10.0_linux_amd64.zip ​ # Move to PATH -weight: 600;">sudo mv vault-radar /usr/local/bin/ ​ # Make executable -weight: 600;">sudo chmod +x /usr/local/bin/vault-radar # Download the binary -weight: 500;">wget https://releases.hashicorp.com/vault-radar/0.10.0/vault-radar_0.10.0_linux_amd64.zip ​ # Unzip unzip vault-radar_0.10.0_linux_amd64.zip ​ # Move to PATH -weight: 600;">sudo mv vault-radar /usr/local/bin/ ​ # Make executable -weight: 600;">sudo chmod +x /usr/local/bin/vault-radar vault-radar --version vault-radar --version vault-radar --version https://portal.cloud.hashicorp.com/orgs/YOUR-ORG/projects/YOUR-PROJECT-ID https://portal.cloud.hashicorp.com/orgs/YOUR-ORG/projects/YOUR-PROJECT-ID https://portal.cloud.hashicorp.com/orgs/YOUR-ORG/projects/YOUR-PROJECT-ID a1b2c3d4-e5f6-7890-abcd-ef1234567890 a1b2c3d4-e5f6-7890-abcd-ef1234567890 a1b2c3d4-e5f6-7890-abcd-ef1234567890 ┌─────────────────────────────────────────────┐ │ Service Principal Created │ ├─────────────────────────────────────────────┤ │ Client ID: │ │ abc123def456ghi789jkl012mno345pq │ │ [Copy] │ │ │ │ Client Secret: (shown only once) │ │ aBcDeFgHiJkLmNoPqRsTuVwXyZ123456... │ │ [Copy] │ │ │ │ ⚠️ Save this secret now. You won't be │ │ able to see it again. │ └─────────────────────────────────────────────┘ ┌─────────────────────────────────────────────┐ │ Service Principal Created │ ├─────────────────────────────────────────────┤ │ Client ID: │ │ abc123def456ghi789jkl012mno345pq │ │ [Copy] │ │ │ │ Client Secret: (shown only once) │ │ aBcDeFgHiJkLmNoPqRsTuVwXyZ123456... │ │ [Copy] │ │ │ │ ⚠️ Save this secret now. You won't be │ │ able to see it again. │ └─────────────────────────────────────────────┘ ┌─────────────────────────────────────────────┐ │ Service Principal Created │ ├─────────────────────────────────────────────┤ │ Client ID: │ │ abc123def456ghi789jkl012mno345pq │ │ [Copy] │ │ │ │ Client Secret: (shown only once) │ │ aBcDeFgHiJkLmNoPqRsTuVwXyZ123456... │ │ [Copy] │ │ │ │ ⚠️ Save this secret now. You won't be │ │ able to see it again. │ └─────────────────────────────────────────────┘ # Replace with your actual values from steps 1 and 2 export HCP_PROJECT_ID="a1b2c3d4-e5f6-7890-abcd-ef1234567890" export HCP_CLIENT_ID="abc123def456ghi789jkl012mno345pq" export HCP_CLIENT_SECRET="aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890AbCdEfGhIjKlMnOpQrStUvWxYz12" # Replace with your actual values from steps 1 and 2 export HCP_PROJECT_ID="a1b2c3d4-e5f6-7890-abcd-ef1234567890" export HCP_CLIENT_ID="abc123def456ghi789jkl012mno345pq" export HCP_CLIENT_SECRET="aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890AbCdEfGhIjKlMnOpQrStUvWxYz12" # Replace with your actual values from steps 1 and 2 export HCP_PROJECT_ID="a1b2c3d4-e5f6-7890-abcd-ef1234567890" export HCP_CLIENT_ID="abc123def456ghi789jkl012mno345pq" export HCP_CLIENT_SECRET="aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890AbCdEfGhIjKlMnOpQrStUvWxYz12" # .env file export HCP_PROJECT_ID="a1b2c3d4-e5f6-7890-abcd-ef1234567890" export HCP_CLIENT_ID="abc123def456ghi789jkl012mno345pq" export HCP_CLIENT_SECRET="aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890AbCdEfGhIjKlMnOpQrStUvWxYz12" # .env file export HCP_PROJECT_ID="a1b2c3d4-e5f6-7890-abcd-ef1234567890" export HCP_CLIENT_ID="abc123def456ghi789jkl012mno345pq" export HCP_CLIENT_SECRET="aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890AbCdEfGhIjKlMnOpQrStUvWxYz12" # .env file export HCP_PROJECT_ID="a1b2c3d4-e5f6-7890-abcd-ef1234567890" export HCP_CLIENT_ID="abc123def456ghi789jkl012mno345pq" export HCP_CLIENT_SECRET="aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890AbCdEfGhIjKlMnOpQrStUvWxYz12" echo ".env" >> .gitignore echo ".env" >> .gitignore echo ".env" >> .gitignore # Source the .env file to load variables into your current shell source .env # Or use this shorthand . .env # Now run vault-radar vault-radar scan folder -p . -o results.json -f json # Source the .env file to load variables into your current shell source .env # Or use this shorthand . .env # Now run vault-radar vault-radar scan folder -p . -o results.json -f json # Source the .env file to load variables into your current shell source .env # Or use this shorthand . .env # Now run vault-radar vault-radar scan folder -p . -o results.json -f json # Add to ~/.bashrc or ~/.bash_profile echo 'export HCP_PROJECT_ID="a1b2c3d4-e5f6-7890-abcd-ef1234567890"' >> ~/.bashrc echo 'export HCP_CLIENT_ID="abc123def456ghi789jkl012mno345pq"' >> ~/.bashrc echo 'export HCP_CLIENT_SECRET="aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890AbCdEfGhIjKlMnOpQrStUvWxYz12"' >> ~/.bashrc ​ # Reload configuration source ~/.bashrc # Add to ~/.bashrc or ~/.bash_profile echo 'export HCP_PROJECT_ID="a1b2c3d4-e5f6-7890-abcd-ef1234567890"' >> ~/.bashrc echo 'export HCP_CLIENT_ID="abc123def456ghi789jkl012mno345pq"' >> ~/.bashrc echo 'export HCP_CLIENT_SECRET="aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890AbCdEfGhIjKlMnOpQrStUvWxYz12"' >> ~/.bashrc ​ # Reload configuration source ~/.bashrc # Add to ~/.bashrc or ~/.bash_profile echo 'export HCP_PROJECT_ID="a1b2c3d4-e5f6-7890-abcd-ef1234567890"' >> ~/.bashrc echo 'export HCP_CLIENT_ID="abc123def456ghi789jkl012mno345pq"' >> ~/.bashrc echo 'export HCP_CLIENT_SECRET="aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890AbCdEfGhIjKlMnOpQrStUvWxYz12"' >> ~/.bashrc ​ # Reload configuration source ~/.bashrc # Add to ~/.zshrc echo 'export HCP_PROJECT_ID="a1b2c3d4-e5f6-7890-abcd-ef1234567890"' >> ~/.zshrc echo 'export HCP_CLIENT_ID="abc123def456ghi789jkl012mno345pq"' >> ~/.zshrc echo 'export HCP_CLIENT_SECRET="aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890AbCdEfGhIjKlMnOpQrStUvWxYz12"' >> ~/.zshrc ​ # Reload configuration source ~/.zshrc # Add to ~/.zshrc echo 'export HCP_PROJECT_ID="a1b2c3d4-e5f6-7890-abcd-ef1234567890"' >> ~/.zshrc echo 'export HCP_CLIENT_ID="abc123def456ghi789jkl012mno345pq"' >> ~/.zshrc echo 'export HCP_CLIENT_SECRET="aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890AbCdEfGhIjKlMnOpQrStUvWxYz12"' >> ~/.zshrc ​ # Reload configuration source ~/.zshrc # Add to ~/.zshrc echo 'export HCP_PROJECT_ID="a1b2c3d4-e5f6-7890-abcd-ef1234567890"' >> ~/.zshrc echo 'export HCP_CLIENT_ID="abc123def456ghi789jkl012mno345pq"' >> ~/.zshrc echo 'export HCP_CLIENT_SECRET="aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890AbCdEfGhIjKlMnOpQrStUvWxYz12"' >> ~/.zshrc ​ # Reload configuration source ~/.zshrc # Just export them in your current terminal export HCP_PROJECT_ID="a1b2c3d4-e5f6-7890-abcd-ef1234567890" export HCP_CLIENT_ID="abc123def456ghi789jkl012mno345pq" export HCP_CLIENT_SECRET="aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890AbCdEfGhIjKlMnOpQrStUvWxYz12" # Just export them in your current terminal export HCP_PROJECT_ID="a1b2c3d4-e5f6-7890-abcd-ef1234567890" export HCP_CLIENT_ID="abc123def456ghi789jkl012mno345pq" export HCP_CLIENT_SECRET="aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890AbCdEfGhIjKlMnOpQrStUvWxYz12" # Just export them in your current terminal export HCP_PROJECT_ID="a1b2c3d4-e5f6-7890-abcd-ef1234567890" export HCP_CLIENT_ID="abc123def456ghi789jkl012mno345pq" export HCP_CLIENT_SECRET="aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890AbCdEfGhIjKlMnOpQrStUvWxYz12" # Check if environment variables are set correctly echo "Project ID: $HCP_PROJECT_ID" echo "Client ID: $HCP_CLIENT_ID" echo "Client Secret: ${HCP_CLIENT_SECRET:0:10}..." # Shows only first 10 chars for security # Verify all three are set and not empty if [ -z "$HCP_PROJECT_ID" ] || [ -z "$HCP_CLIENT_ID" ] || [ -z "$HCP_CLIENT_SECRET" ]; then echo "❌ Error: One or more HCP environment variables are not set" else echo "✅ All HCP environment variables are set" fi # Test with a simple scan vault-radar scan folder -p . -o test-scan.json -f json # Check if environment variables are set correctly echo "Project ID: $HCP_PROJECT_ID" echo "Client ID: $HCP_CLIENT_ID" echo "Client Secret: ${HCP_CLIENT_SECRET:0:10}..." # Shows only first 10 chars for security # Verify all three are set and not empty if [ -z "$HCP_PROJECT_ID" ] || [ -z "$HCP_CLIENT_ID" ] || [ -z "$HCP_CLIENT_SECRET" ]; then echo "❌ Error: One or more HCP environment variables are not set" else echo "✅ All HCP environment variables are set" fi # Test with a simple scan vault-radar scan folder -p . -o test-scan.json -f json # Check if environment variables are set correctly echo "Project ID: $HCP_PROJECT_ID" echo "Client ID: $HCP_CLIENT_ID" echo "Client Secret: ${HCP_CLIENT_SECRET:0:10}..." # Shows only first 10 chars for security # Verify all three are set and not empty if [ -z "$HCP_PROJECT_ID" ] || [ -z "$HCP_CLIENT_ID" ] || [ -z "$HCP_CLIENT_SECRET" ]; then echo "❌ Error: One or more HCP environment variables are not set" else echo "✅ All HCP environment variables are set" fi # Test with a simple scan vault-radar scan folder -p . -o test-scan.json -f json # 1. Verify variables are loaded env | grep HCP # 2. Check the format of your credentials echo "Project ID length: ${#HCP_PROJECT_ID}" # Should be 36 (UUID format) echo "Client ID length: ${#HCP_CLIENT_ID}" # Should be 32+ echo "Client Secret length: ${#HCP_CLIENT_SECRET}" # Should be 60+ # 3. If using .env file, make sure you sourced it source .env # 4. Try the scan again vault-radar scan folder -p . -o test-scan.json -f json # 1. Verify variables are loaded env | grep HCP # 2. Check the format of your credentials echo "Project ID length: ${#HCP_PROJECT_ID}" # Should be 36 (UUID format) echo "Client ID length: ${#HCP_CLIENT_ID}" # Should be 32+ echo "Client Secret length: ${#HCP_CLIENT_SECRET}" # Should be 60+ # 3. If using .env file, make sure you sourced it source .env # 4. Try the scan again vault-radar scan folder -p . -o test-scan.json -f json # 1. Verify variables are loaded env | grep HCP # 2. Check the format of your credentials echo "Project ID length: ${#HCP_PROJECT_ID}" # Should be 36 (UUID format) echo "Client ID length: ${#HCP_CLIENT_ID}" # Should be 32+ echo "Client Secret length: ${#HCP_CLIENT_SECRET}" # Should be 60+ # 3. If using .env file, make sure you sourced it source .env # 4. Try the scan again vault-radar scan folder -p . -o test-scan.json -f json # Scan all files in current directory (requires output file) vault-radar scan folder -p . -o results.json -f json # Scan all files in current directory (requires output file) vault-radar scan folder -p . -o results.json -f json # Scan all files in current directory (requires output file) vault-radar scan folder -p . -o results.json -f json # Scan .env file vault-radar scan folder -p .env -o env-scan.json -f json # Scan YAML files vault-radar scan folder -p config.yaml -o config-scan.json -f json # Scan .env file vault-radar scan folder -p .env -o env-scan.json -f json # Scan YAML files vault-radar scan folder -p config.yaml -o config-scan.json -f json # Scan .env file vault-radar scan folder -p .env -o env-scan.json -f json # Scan YAML files vault-radar scan folder -p config.yaml -o config-scan.json -f json # Scan current directory recursively vault-radar scan folder -p . -o results.json # Scan specific directory vault-radar scan folder -p /path/to/project -o scan-results.json # Scan current directory recursively vault-radar scan folder -p . -o results.json # Scan specific directory vault-radar scan folder -p /path/to/project -o scan-results.json # Scan current directory recursively vault-radar scan folder -p . -o results.json # Scan specific directory vault-radar scan folder -p /path/to/project -o scan-results.json # Scan and save results to JSON vault-radar scan folder -p . -o results.json -f json # Scan and save results to CSV vault-radar scan folder -p . -o results.csv -f csv # Scan and save results to SARIF format vault-radar scan folder -p . -o results.sarif -f sarif # Scan and save results to JSON vault-radar scan folder -p . -o results.json -f json # Scan and save results to CSV vault-radar scan folder -p . -o results.csv -f csv # Scan and save results to SARIF format vault-radar scan folder -p . -o results.sarif -f sarif # Scan and save results to JSON vault-radar scan folder -p . -o results.json -f json # Scan and save results to CSV vault-radar scan folder -p . -o results.csv -f csv # Scan and save results to SARIF format vault-radar scan folder -p . -o results.sarif -f sarif # Scan specific .env file vault-radar scan folder -p .env -o env-scan.json -f json # Scan current directory (will include .env files) vault-radar scan folder -p . -o scan-results.json -f json # Scan specific .env file vault-radar scan folder -p .env -o env-scan.json -f json # Scan current directory (will include .env files) vault-radar scan folder -p . -o scan-results.json -f json # Scan specific .env file vault-radar scan folder -p .env -o env-scan.json -f json # Scan current directory (will include .env files) vault-radar scan folder -p . -o scan-results.json -f json # Scan current directory (will include YAML files) vault-radar scan folder -p . -o results.json -f json # Scan specific config file vault-radar scan folder -p config/application.yaml -o config-scan.json -f json # Scan current directory (will include YAML files) vault-radar scan folder -p . -o results.json -f json # Scan specific config file vault-radar scan folder -p config/application.yaml -o config-scan.json -f json # Scan current directory (will include YAML files) vault-radar scan folder -p . -o results.json -f json # Scan specific config file vault-radar scan folder -p config/application.yaml -o config-scan.json -f json # .vault-radar.yaml scan: # Paths to scan paths: - . # File patterns to include include: - "*.env" - "*.yaml" - "*.yml" - "*.json" - "*.py" - "*.js" - "*.ts" # Directories to exclude exclude: - "node_modules" - "venv" - ".-weight: 500;">git" - "__pycache__" - "dist" - "build" # Output format (json, sarif, csv) output_format: json # Output file output_file: vault-radar-results.json # Risk levels to report (critical, high, medium, low) risk_levels: - critical - high - medium # Custom patterns (optional) custom_patterns: - name: "Custom API Key" pattern: "custom_api_[a-zA-Z0-9]{32}" risk: high # .vault-radar.yaml scan: # Paths to scan paths: - . # File patterns to include include: - "*.env" - "*.yaml" - "*.yml" - "*.json" - "*.py" - "*.js" - "*.ts" # Directories to exclude exclude: - "node_modules" - "venv" - ".-weight: 500;">git" - "__pycache__" - "dist" - "build" # Output format (json, sarif, csv) output_format: json # Output file output_file: vault-radar-results.json # Risk levels to report (critical, high, medium, low) risk_levels: - critical - high - medium # Custom patterns (optional) custom_patterns: - name: "Custom API Key" pattern: "custom_api_[a-zA-Z0-9]{32}" risk: high # .vault-radar.yaml scan: # Paths to scan paths: - . # File patterns to include include: - "*.env" - "*.yaml" - "*.yml" - "*.json" - "*.py" - "*.js" - "*.ts" # Directories to exclude exclude: - "node_modules" - "venv" - ".-weight: 500;">git" - "__pycache__" - "dist" - "build" # Output format (json, sarif, csv) output_format: json # Output file output_file: vault-radar-results.json # Risk levels to report (critical, high, medium, low) risk_levels: - critical - high - medium # Custom patterns (optional) custom_patterns: - name: "Custom API Key" pattern: "custom_api_[a-zA-Z0-9]{32}" risk: high # Example using values from .vault-radar.yaml vault-radar scan folder \ -p . \ -o vault-radar-results.json \ -f json # Example using values from .vault-radar.yaml vault-radar scan folder \ -p . \ -o vault-radar-results.json \ -f json # Example using values from .vault-radar.yaml vault-radar scan folder \ -p . \ -o vault-radar-results.json \ -f json vault-radar scan folder -p . -o results.json -f json vault-radar scan folder -p . -o results.json -f json vault-radar scan folder -p . -o results.json -f json { "findings": [ { "type": "AWS Access Key", "file": ".env", "line": 5, "risk": "critical", "value": "AKIA****************", "description": "AWS Access Key ID detected" }, { "type": "Generic API Key", "file": "config.yaml", "line": 12, "risk": "high", "value": "sk_live_***************", "description": "API key pattern detected" } ], "summary": { "total_files_scanned": 45, "total_findings": 2, "critical": 1, "high": 1, "medium": 0, "low": 0 } } { "findings": [ { "type": "AWS Access Key", "file": ".env", "line": 5, "risk": "critical", "value": "AKIA****************", "description": "AWS Access Key ID detected" }, { "type": "Generic API Key", "file": "config.yaml", "line": 12, "risk": "high", "value": "sk_live_***************", "description": "API key pattern detected" } ], "summary": { "total_files_scanned": 45, "total_findings": 2, "critical": 1, "high": 1, "medium": 0, "low": 0 } } { "findings": [ { "type": "AWS Access Key", "file": ".env", "line": 5, "risk": "critical", "value": "AKIA****************", "description": "AWS Access Key ID detected" }, { "type": "Generic API Key", "file": "config.yaml", "line": 12, "risk": "high", "value": "sk_live_***************", "description": "API key pattern detected" } ], "summary": { "total_files_scanned": 45, "total_findings": 2, "critical": 1, "high": 1, "medium": 0, "low": 0 } } vault-radar scan folder -p . -o results.sarif -f sarif vault-radar scan folder -p . -o results.sarif -f sarif vault-radar scan folder -p . -o results.sarif -f sarif vault-radar scan folder -p . -o results.csv -f csv # or simply (csv is default) vault-radar scan folder -p . -o results.csv vault-radar scan folder -p . -o results.csv -f csv # or simply (csv is default) vault-radar scan folder -p . -o results.csv vault-radar scan folder -p . -o results.csv -f csv # or simply (csv is default) vault-radar scan folder -p . -o results.csv #!/bin/bash # pre-commit-scan.sh # Ensure HCP credentials are set if [ -z "$HCP_PROJECT_ID" ]; then echo "Error: HCP_PROJECT_ID not set" exit 1 fi echo "Scanning for secrets..." vault-radar scan folder -p . -o scan-results.json -f json if [ $? -ne 0 ]; then echo "❌ Secrets detected! Please -weight: 500;">remove them before committing." cat scan-results.json exit 1 fi echo "✅ No secrets detected." #!/bin/bash # pre-commit-scan.sh # Ensure HCP credentials are set if [ -z "$HCP_PROJECT_ID" ]; then echo "Error: HCP_PROJECT_ID not set" exit 1 fi echo "Scanning for secrets..." vault-radar scan folder -p . -o scan-results.json -f json if [ $? -ne 0 ]; then echo "❌ Secrets detected! Please -weight: 500;">remove them before committing." cat scan-results.json exit 1 fi echo "✅ No secrets detected." #!/bin/bash # pre-commit-scan.sh # Ensure HCP credentials are set if [ -z "$HCP_PROJECT_ID" ]; then echo "Error: HCP_PROJECT_ID not set" exit 1 fi echo "Scanning for secrets..." vault-radar scan folder -p . -o scan-results.json -f json if [ $? -ne 0 ]; then echo "❌ Secrets detected! Please -weight: 500;">remove them before committing." cat scan-results.json exit 1 fi echo "✅ No secrets detected." # .github/workflows/security-scan.yml name: Security Scan on: [push, pull_request] jobs: scan-secrets: runs-on: ubuntu-latest steps: - uses: actions/checkout@v3 - name: Install Vault Radar run: | -weight: 500;">wget https://releases.hashicorp.com/vault-radar/0.10.0/vault-radar_0.10.0_linux_amd64.zip unzip vault-radar_0.10.0_linux_amd64.zip -weight: 600;">sudo mv vault-radar /usr/local/bin/ - name: Scan for secrets env: HCP_PROJECT_ID: ${{ secrets.HCP_PROJECT_ID }} HCP_CLIENT_ID: ${{ secrets.HCP_CLIENT_ID }} HCP_CLIENT_SECRET: ${{ secrets.HCP_CLIENT_SECRET }} run: | vault-radar scan folder -p . -o results.sarif -f sarif - name: Upload results uses: github/codeql-action/upload-sarif@v2 with: sarif_file: results.sarif # .github/workflows/security-scan.yml name: Security Scan on: [push, pull_request] jobs: scan-secrets: runs-on: ubuntu-latest steps: - uses: actions/checkout@v3 - name: Install Vault Radar run: | -weight: 500;">wget https://releases.hashicorp.com/vault-radar/0.10.0/vault-radar_0.10.0_linux_amd64.zip unzip vault-radar_0.10.0_linux_amd64.zip -weight: 600;">sudo mv vault-radar /usr/local/bin/ - name: Scan for secrets env: HCP_PROJECT_ID: ${{ secrets.HCP_PROJECT_ID }} HCP_CLIENT_ID: ${{ secrets.HCP_CLIENT_ID }} HCP_CLIENT_SECRET: ${{ secrets.HCP_CLIENT_SECRET }} run: | vault-radar scan folder -p . -o results.sarif -f sarif - name: Upload results uses: github/codeql-action/upload-sarif@v2 with: sarif_file: results.sarif # .github/workflows/security-scan.yml name: Security Scan on: [push, pull_request] jobs: scan-secrets: runs-on: ubuntu-latest steps: - uses: actions/checkout@v3 - name: Install Vault Radar run: | -weight: 500;">wget https://releases.hashicorp.com/vault-radar/0.10.0/vault-radar_0.10.0_linux_amd64.zip unzip vault-radar_0.10.0_linux_amd64.zip -weight: 600;">sudo mv vault-radar /usr/local/bin/ - name: Scan for secrets env: HCP_PROJECT_ID: ${{ secrets.HCP_PROJECT_ID }} HCP_CLIENT_ID: ${{ secrets.HCP_CLIENT_ID }} HCP_CLIENT_SECRET: ${{ secrets.HCP_CLIENT_SECRET }} run: | vault-radar scan folder -p . -o results.sarif -f sarif - name: Upload results uses: github/codeql-action/upload-sarif@v2 with: sarif_file: results.sarif #!/bin/bash # scan-all.sh directories=("src" "config" "scripts" "tests") for dir in "${directories[@]}"; do echo "Scanning $dir..." vault-radar scan folder -p "$dir" -o "scan-$dir.json" done #!/bin/bash # scan-all.sh directories=("src" "config" "scripts" "tests") for dir in "${directories[@]}"; do echo "Scanning $dir..." vault-radar scan folder -p "$dir" -o "scan-$dir.json" done #!/bin/bash # scan-all.sh directories=("src" "config" "scripts" "tests") for dir in "${directories[@]}"; do echo "Scanning $dir..." vault-radar scan folder -p "$dir" -o "scan-$dir.json" done # First scan - establish baseline vault-radar scan folder -p . -o baseline.json -f json # Later scan - compare against baseline (only new secrets reported) vault-radar scan folder -p . -o new-findings.json -f json -b baseline.json # First scan - establish baseline vault-radar scan folder -p . -o baseline.json -f json # Later scan - compare against baseline (only new secrets reported) vault-radar scan folder -p . -o new-findings.json -f json -b baseline.json # First scan - establish baseline vault-radar scan folder -p . -o baseline.json -f json # Later scan - compare against baseline (only new secrets reported) vault-radar scan folder -p . -o new-findings.json -f json -b baseline.json # Add to crontab for daily scans 0 2 * * * cd /path/to/project && vault-radar scan folder -p . -o daily-scan.jsonLinks & resources # Add to crontab for daily scans 0 2 * * * cd /path/to/project && vault-radar scan folder -p . -o daily-scan.jsonLinks & resources # Add to crontab for daily scans 0 2 * * * cd /path/to/project && vault-radar scan folder -p . -o daily-scan.jsonLinks & resources # Ignore test files with dummy secrets tests/fixtures/test-secrets.env tests/mock-data.yaml # Ignore documentation examples docs/examples/*.md # Ignore test files with dummy secrets tests/fixtures/test-secrets.env tests/mock-data.yaml # Ignore documentation examples docs/examples/*.md # Ignore test files with dummy secrets tests/fixtures/test-secrets.env tests/mock-data.yaml # Ignore documentation examples docs/examples/*.md # .-weight: 500;">git/hooks/pre-commit #!/bin/bash vault-radar scan folder -p . -o pre-commit-scan.json -f json if [ $? -ne 0 ]; then echo "Secrets detected!" cat pre-commit-scan.json exit 1 fi # .-weight: 500;">git/hooks/pre-commit #!/bin/bash vault-radar scan folder -p . -o pre-commit-scan.json -f json if [ $? -ne 0 ]; then echo "Secrets detected!" cat pre-commit-scan.json exit 1 fi # .-weight: 500;">git/hooks/pre-commit #!/bin/bash vault-radar scan folder -p . -o pre-commit-scan.json -f json if [ $? -ne 0 ]; then echo "Secrets detected!" cat pre-commit-scan.json exit 1 fi -weight: 500;">git log -p | grep -i "secret_pattern" -weight: 500;">git log -p | grep -i "secret_pattern" -weight: 500;">git log -p | grep -i "secret_pattern" # Scan the current project for secrets vault-radar scan folder -p /Users/alainairom/Devs/ibm-cos \ -o ibm-cos-scan.json \ -f json # View results cat ibm-cos-scan.json | jq '.findings' # Count findings by risk level cat ibm-cos-scan.json | jq '.summary' # Scan the current project for secrets vault-radar scan folder -p /Users/alainairom/Devs/ibm-cos \ -o ibm-cos-scan.json \ -f json # View results cat ibm-cos-scan.json | jq '.findings' # Count findings by risk level cat ibm-cos-scan.json | jq '.summary' # Scan the current project for secrets vault-radar scan folder -p /Users/alainairom/Devs/ibm-cos \ -o ibm-cos-scan.json \ -f json # View results cat ibm-cos-scan.json | jq '.findings' # Count findings by risk level cat ibm-cos-scan.json | jq '.summary' # Error: HCP_PROJECT_ID environment variable must be set # Error: HCP_PROJECT_ID environment variable must be set # Error: HCP_PROJECT_ID environment variable must be set # Set required environment variables export HCP_PROJECT_ID="your-project-id" export HCP_CLIENT_ID="your-client-id" export HCP_CLIENT_SECRET="your-client-secret" # Verify they are set env | grep HCP # Try scanning again vault-radar scan folder -p . -o results.json -f json # Set required environment variables export HCP_PROJECT_ID="your-project-id" export HCP_CLIENT_ID="your-client-id" export HCP_CLIENT_SECRET="your-client-secret" # Verify they are set env | grep HCP # Try scanning again vault-radar scan folder -p . -o results.json -f json # Set required environment variables export HCP_PROJECT_ID="your-project-id" export HCP_CLIENT_ID="your-client-id" export HCP_CLIENT_SECRET="your-client-secret" # Verify they are set env | grep HCP # Try scanning again vault-radar scan folder -p . -o results.json -f json # Use baseline to track only new secrets vault-radar scan folder -p . -o current.json -f json -b previous.json # Limit number of secrets reported vault-radar scan folder -p . -o results.json -f json -l 50 # Use baseline to track only new secrets vault-radar scan folder -p . -o current.json -f json -b previous.json # Limit number of secrets reported vault-radar scan folder -p . -o results.json -f json -l 50 # Use baseline to track only new secrets vault-radar scan folder -p . -o current.json -f json -b previous.json # Limit number of secrets reported vault-radar scan folder -p . -o results.json -f json -l 50 # Scan specific directories only vault-radar scan folder -p src -o src-scan.json -f json vault-radar scan folder -p config -o config-scan.json -f json # Skip activeness checks for faster scanning vault-radar scan folder -p . -o results.json -f json --skip-activeness # Scan specific directories only vault-radar scan folder -p src -o src-scan.json -f json vault-radar scan folder -p config -o config-scan.json -f json # Skip activeness checks for faster scanning vault-radar scan folder -p . -o results.json -f json --skip-activeness # Scan specific directories only vault-radar scan folder -p src -o src-scan.json -f json vault-radar scan folder -p config -o config-scan.json -f json # Skip activeness checks for faster scanning vault-radar scan folder -p . -o results.json -f json --skip-activeness # Disable UI output (summary not logged to stdout) vault-radar scan folder -p . -o results.json -f json ---weight: 500;">disable-ui # Disable UI output (summary not logged to stdout) vault-radar scan folder -p . -o results.json -f json ---weight: 500;">disable-ui # Disable UI output (summary not logged to stdout) vault-radar scan folder -p . -o results.json -f json ---weight: 500;">disable-ui # 1. Scan for secrets vault-radar scan folder -p . -o findings.json # 2. Extract secrets from findings cat findings.json | jq -r '.findings[] | .file + ":" + (.line|tostring)' # 3. Store in Vault (manual or scripted) vault kv put secret/myapp/config \ api_key="value-from-env-file" \ db_password="value-from-config" # 4. Update code to use Vault # See VAULT_CONFIGURATION.md for integration details # 1. Scan for secrets vault-radar scan folder -p . -o findings.json # 2. Extract secrets from findings cat findings.json | jq -r '.findings[] | .file + ":" + (.line|tostring)' # 3. Store in Vault (manual or scripted) vault kv put secret/myapp/config \ api_key="value-from-env-file" \ db_password="value-from-config" # 4. Update code to use Vault # See VAULT_CONFIGURATION.md for integration details # 1. Scan for secrets vault-radar scan folder -p . -o findings.json # 2. Extract secrets from findings cat findings.json | jq -r '.findings[] | .file + ":" + (.line|tostring)' # 3. Store in Vault (manual or scripted) vault kv put secret/myapp/config \ api_key="value-from-env-file" \ db_password="value-from-config" # 4. Update code to use Vault # See VAULT_CONFIGURATION.md for integration details # Basic scan (requires output file) vault-radar scan folder -p <path> -o <output-file> # With format (csv, json, or sarif) vault-radar scan folder -p <path> -o <output-file> -f json # With baseline comparison vault-radar scan folder -p <path> -o <output-file> -b previous-scan.json # With limit on number of secrets vault-radar scan folder -p <path> -o <output-file> -l 100 # Disable UI output vault-radar scan folder -p <path> -o <output-file> ---weight: 500;">disable-ui # Skip activeness checks vault-radar scan folder -p <path> -o <output-file> --skip-activeness # Scan -weight: 500;">git repository vault-radar scan repo -u <-weight: 500;">git-url> # Version vault-radar --version # Help vault-radar --help vault-radar scan folder --help # Basic scan (requires output file) vault-radar scan folder -p <path> -o <output-file> # With format (csv, json, or sarif) vault-radar scan folder -p <path> -o <output-file> -f json # With baseline comparison vault-radar scan folder -p <path> -o <output-file> -b previous-scan.json # With limit on number of secrets vault-radar scan folder -p <path> -o <output-file> -l 100 # Disable UI output vault-radar scan folder -p <path> -o <output-file> ---weight: 500;">disable-ui # Skip activeness checks vault-radar scan folder -p <path> -o <output-file> --skip-activeness # Scan -weight: 500;">git repository vault-radar scan repo -u <-weight: 500;">git-url> # Version vault-radar --version # Help vault-radar --help vault-radar scan folder --help # Basic scan (requires output file) vault-radar scan folder -p <path> -o <output-file> # With format (csv, json, or sarif) vault-radar scan folder -p <path> -o <output-file> -f json # With baseline comparison vault-radar scan folder -p <path> -o <output-file> -b previous-scan.json # With limit on number of secrets vault-radar scan folder -p <path> -o <output-file> -l 100 # Disable UI output vault-radar scan folder -p <path> -o <output-file> ---weight: 500;">disable-ui # Skip activeness checks vault-radar scan folder -p <path> -o <output-file> --skip-activeness # Scan -weight: 500;">git repository vault-radar scan repo -u <-weight: 500;">git-url> # Version vault-radar --version # Help vault-radar --help vault-radar scan folder --help - Secrets: It identifies passwords, tokens, and keys. Crucially, it can distinguish between an inactive string and an active secret, helping teams prioritize the most critical threats. - Personally Identifiable Information (PII): As global privacy regulations (like GDPR and CCPA) tighten, Vault Radar helps identify sensitive user data that shouldn’t be in your codebase. - Non-Inclusive Language (NIL): It helps maintain brand integrity and community standards by flagging non-inclusive terms in your documentation and code. - Real-Time Scanning: It scans as you work, checking new commits and pull requests (PRs). - Historical Deep Scans: It analyzes the entire Git history of a repository to find “zombie” secrets. - Prioritized Remediation: Using a sophisticated severity ranking (from Info to Critical), it tells security teams exactly what needs immediate attention based on whether a secret is active and where it is located. - Verify Installation - Go to HashiCorp Cloud Platform - Sign in or create a free account - Once logged in, either you create OR you’ll see your organization and projects - Click on your project name - Look at the URL in your browser — it will look like: - In your project, click the ⚙️ Settings icon in the left sidebar - The Project ID is displayed at the top of the settings page - In your HCP project, click Access control (IAM) in the left sidebar - Click the Service principals tab - Click Create -weight: 500;">service principal - Give it a name (e.g., “vault-radar-scanner”) - Assign it the Contributor role (or a custom role with Vault Radar permissions) - After clicking Save, a popup/modal will immediately appear with: - Client ID (you can view this later) - Client Secret (⚠️ ONLY SHOWN NOW — cannot be retrieved later!) - Click the [Copy] button next to the Client Secret or manually select and copy the entire secret string. - Go back to Access control (IAM) → Service principals - Create a new -weight: 500;">service principal (give it a different name like “vault-radar-scanner-2”) - This time, copy the Client Secret immediately - Optionally, delete the old -weight: 500;">service principal you can’t use Option B: Generate a New Key for Existing Service Principal - Go to Access control (IAM) → Service principals - Click on your existing -weight: 500;">service principal - Look for Keys or Client credentials section - Click Generate new key or Create key - Copy the new Client Secret immediately (the old one will be invalidated). - Create a .env file in your project directory: - Important: Add .env to your .gitignore to avoid committing secrets: - Load the .env file before running vault-radar: - For Bash users: - For Zsh users (macOS default): - For temporary use (current session only): - You haven’t exported the variables in your current terminal session - If using a .env file, you forgot to run source .env - Solution: Run source .env or export the variables directly Error: 404 Not Found or failed to get config options - Vault Radar is not enabled in your HCP project - The project ID may be incorrect - Your HCP_CLIENT_ID or HCP_CLIENT_SECRET is incorrect - The -weight: 500;">service principal may have been deleted or disabled - The credentials may have expired or been rotated - Network connectivity issues - HCP -weight: 500;">service may be temporarily unavailable - Firewall or proxy blocking access to HCP - Make sure you’re in a project (not just the organization view) - You need appropriate permissions — contact your HCP organization admin if you can’t create -weight: 500;">service principals - The Client Secret is only displayed once when you create the -weight: 500;">service principal or generate a new key - You cannot view it again in the HCP console - You can switch between projects by changing the HCP_PROJECT_ID variable - Consider creating separate -weight: 500;">service principals for each project - Scan with Output - Scan .envFiles - Scan YAML Configuration Files - Create a configuration YAML file (create .vault-radar.yaml in your project root) - Using Configuration Values: while vault-radar doesn’t support a --config flag, you can use the configuration file as a reference and pass the values as command-line arguments: - JSON Output request - The JSON output file - SARIF Output (for CI/CD) - Default CSV Output - AWS Access Keys - Azure Storage Keys - Google Cloud API Keys - IBM Cloud API Keys - GitHub Personal Access Tokens - GitLab Tokens - Slack Tokens - Stripe API Keys - SendGrid API Keys - PostgreSQL connection strings - MySQL passwords - MongoDB URIs - Redis passwords - RSA Private Keys - SSH Private Keys - PGP Private Keys - Bearer Tokens - API Keys (generic patterns) - Passwords in configuration files - Regular Scanning - Exclude False Positives: Create .vault-radar-ignore - Integrate with Git Hooks - Remediation Workflow 🔥 When secrets are found: - Example: Scanning This Project; - Issue: Authentication Error - Issue: Too Many Results - Issue: Slow Scanning - Issue: Need Quiet Output - After finding secrets with Vault Radar, migrate them to HashiCorp Vault: - HashiCorp Cloud Platform: https://portal.cloud.hashicorp.com/sign-in - Vault Radar Documentation: https://developer.hashicorp.com/hcp/docs/vault-radar - Vault Radar CLI: https://developer.hashicorp.com/hcp/docs/vault-radar/cli - Vault Radar Demos: https://github.com/hashicorp-guides/vault-radar-demo - Vault Radar FAQ: https://developer.hashicorp.com/hcp/docs/vault-radar/faq - HashiCorp Radar Documentation: https://developer.hashicorp.com/vault/docs/radar - HashiCorp Security: https://www.hashicorp.com/en/trust/security - OWASP Cheat Sheet Series: https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html