Client: New option for scanning the SCM history

mercedes-benz / sechub

SecHub provides a central API to test software with different security tools.

https://mercedes-benz.github.io/sechub/

MIT License

259 stars 58 forks source link

Client: New option for scanning the SCM history #3079

Closed sven-dmlr closed 2 months ago

sven-dmlr commented 2 months ago

Situation

The SecHub client per default add only source code files. See explanation in #3078

Many secrets scanners are able to scan the scm history (e.g. .git folder) in order to find secrets that were checked in once.

Wanted

A client option -addScmHistory / environment variable SECHUB_ADD_SCM_HISTORY so the .git folder is being uploaded to the SecHub server for scanning.