XRAY: Creating and Using a Custom Secrets Scanner in JFrog Xray Advanced Security

Overview

This article explains how to create and use a Custom Secrets Scanner in JFrog Xray Advanced Security.

Custom scanners allow organizations to extend Xray’s built-in secrets detection engine to identify organization-specific sensitive patterns such as:

```
Internal API keys
```
```
Proprietary tokens
```
```
Custom credential formats
```
```
Internal configuration secrets
```

This capability strengthens governance and enhances DevSecOps security posture.


What is a Custom Secrets Scanner?

A Custom Secrets Scanner enables the user to define custom detection rules typically using RE2-based regular expressions to scan artifacts for sensitive information.

When a match is found:

The scan result displays the configured severity

The configured description appears in the findings

The issue is logged within Xray exposure results

When Should You Use a Custom Secrets Scanner?

Use a custom scanner when organization:

Uses proprietary token or credential formats

Requires stricter internal compliance enforcement

Needs centralized governance for internal secret patterns

Wants visibility into configuration based credential exposure

How to Create a Custom Secrets Scanner

Step 1: Navigate to Advanced Security
Go to: Administration → Advanced Security → Secrets Scanning → Custom Scanners

 


Step 2: Create New Scanner
Select Create New Scanner and fill in the required fields as shown below:

 
 


Example Custom Regex Pattern: \bDEVELOPER_USER_CREDENTIALS\s*=\s*["'][^"'\r\n]+["']
This regex detects hardcoded credentials defined in configuration or source files such as: DEVELOPER_USER_CREDENTIALS="my-secret-token"

When a scanner is created, corresponding events are logged in Xray service logs.

console.log:
2026-02-24T08:18:25.607Z [jfxr ] [INFO ] [71d898d3848ac76a80ecda163c5e207a] [exposures_dao:852             ] [api…rnal/exposure_custom_scanner] Inserted exposure scanner, id: 10001
2026-02-24T08:18:25.607Z [jfxr ] [INFO ] [71d898d3848ac76a80ecda163c5e207a] [exposures_service:1516        ] [api…rnal/exposure_custom_scanner] Created custom scanner event server_jas_custom_scanner_create


Updating a Custom Secrets Scanner:
You can modify an existing scanner at any time using the Edit option from the Custom Scanners page.

 


An Example of Custom Secrets Scanner identifier:
The following examples use a sample NPM project uploaded to Artifactory and scanned by Xray.

 

After Creating/Enabling Custom Scanner, Xray identifies secrets using the regex: \bDEVELOPER_USER_CREDENTIALS\s*=\s*["'][^"'\r\n]+["'] along with built-in secret detection identifiers.

 


Log References:
console.log
2026-02-24T08:23:24.384Z [jfxan] [INFO ] [4fa673df09039813] [exposures_service:1396        ] […cab-9bd0-4c46-882f-e0a366f4bdab] Exposures service triggered PolicyEnforcer for "default/harithaa-npm-local/vuln-app/-/" Number of Issues found: 2


Conclusion

Custom Secrets Scanners in JFrog Xray Advanced Security allow organizations to extend secret detection beyond default rules.

By implementing organization specific patterns, teams can:

```
Prevent accidental credential exposure
```

Strengthen internal compliance enforcement

Enhance visibility into proprietary authentication mechanisms

Improve overall DevSecOps security posture

This capability is especially valuable for enterprises with:

```
Internal authentication systems
```
```
Proprietary APIs
```
```
Regulated environments
```

By leveraging custom secret detection, organizations can proactively reduce risk and enforce secure development practices at scale.