Introduction
Frogbot may detect secrets during a pull request scan but not decorate the pull request with the findings. SAST violations are flagged and decorated correctly, but secret exposures only appear in the JFrog Platform under Scans List while the PR badge remains green.
Symptoms
Frogbot logs confirm that secrets are detected and violations are found, but no comment is created on the pull request. Instead, Frogbot deletes any existing comment and completes successfully without posting new findings.
17:12:37 [Info] Found 1 violations: [1 Secrets]
17:12:37 [Debug] Diff scan - converting to new issues...
17:12:37 [Debug] Looking for an existing Frogbot pull request comment. Deleting it if it exists...
17:12:37 [Debug] Deleting comment id: XXXXXXXXXX
17:12:39 [Info] Frogbot "scan-pull-request" command finished successfully
This behaviour occurs across all repositories and multiple file types including JSON, YAML, and MOD files. SAST findings continue to decorate PRs as expected.
Cause
The Frogbot parameter JF_PR_SHOW_SECRETS_COMMENTS is set to false by default. When disabled, secret detection findings are intentionally omitted from pull request comments to prevent accidental exposure of sensitive values in PR decorations. The scan results are still recorded in the JFrog Platform under Scans List, but no PR comment is created for secrets.
Resolution
Enable the JF_PR_SHOW_SECRETS_COMMENTS parameter in your Frogbot GitHub Actions workflow configuration by setting it to true:
JF_PR_SHOW_SECRETS_COMMENTS: true
After enabling this parameter, trigger a new pull request scan and verify that secret findings now appear as comments on the PR.
Related Links