microsoft / microsoft/azure-tools-for-java
Public information marked as secret
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 262
- Forks
- 185
- Avg merge
- 2d 21h
- Merged PRs (30d)
- 1
Description
In my Spring Boot configuration, public information like the SSL key store type and key alias are listed as "secret". Worse, this cannot be turned off!
The good: secrets like passwords are recognised
The bad: public information like aliases are marked as secret, which they are not
The ugly: there is no setting to fix this
The core of the problem is that this is implemented as an annotator. Please make this an inspection instead. This also allows you to add configuration, for example to add/remove patterns for more secrets, whitelist non-secrets, etc.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Locate the Spring Boot configuration secret annotator and review how it identifies passwords, aliases, and keystore types. Convert the behavior to a configurable inspection with pattern and whitelist settings; done means public SSL metadata is not marked secret while passwords remain recognized.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring-boot
- Domain
- security, tooling
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100