feat(security): built-in security scanning platform for repositories #508

New Issue

2026-06-06T14:44:43Z

jmiller commented

2026-06-06 14:44:43 +00:00

Priority: HIGH

Summary

Add built-in secret scanning as a core MokoGitea feature that:

Scans every push for accidentally committed secrets (API keys, tokens, passwords, private keys)
Repo settings screen showing scan results, false positive management, and alert history
Push rejection (optional) blocking pushes that contain detected secrets
Dashboard for org admins showing secret exposure across all repos

Scope

1. Secret Detection Engine

Built into MokoGitea (not an external tool), scanning:

API keys (AWS, GCP, Azure, Stripe, etc.)
Tokens (GitHub/Gitea personal access tokens, OAuth tokens, JWTs)
Passwords in connection strings (database URLs, SMTP, Redis)
Private keys (SSH, PGP, TLS certificates)
Custom patterns defined at org level

Detection uses regex patterns with entropy analysis to reduce false positives.

2. Repo Settings Screen

Add a Security tab in repo settings showing:

Active alerts (secrets found, not yet resolved)
Resolved alerts (acknowledged false positives or rotated secrets)
Scan history (last scan date, commits scanned)
Allow/block list for specific patterns
Toggle for push rejection mode

3. Push-Time Scanning

On every push (via the pre-receive hook or post-receive processing):

Scan new commits for secrets
If push rejection is enabled: block the push and return an error message explaining which file/line contains the secret
If push rejection is disabled: allow the push but create an alert
Send notification to repo admins

4. Org-Level Dashboard

Org settings page showing:

Total alerts across all repos
Most common secret types found
Repos with unresolved alerts
Custom pattern management (org-wide regex patterns)

5. API

- list alerts
- resolve/dismiss alert
- org-wide alert summary

Built-In Patterns

Pattern	Example Match
AWS Access Key
AWS Secret Key	40-char base64 after aws_secret
GitHub/Gitea Token	, , token patterns
Private Key
Generic Password
Connection String
JWT

Motivation

Secret leaks are one of the most common and damaging security incidents. GitHub has this feature built-in. Making it inherent to MokoGitea (not an optional plugin) ensures all repos are protected by default.

Authored by Jonathan Miller (@jmiller)

## Priority: HIGH ## Summary Add built-in secret scanning as a core MokoGitea feature that: 1. **Scans every push** for accidentally committed secrets (API keys, tokens, passwords, private keys) 2. **Repo settings screen** showing scan results, false positive management, and alert history 3. **Push rejection** (optional) blocking pushes that contain detected secrets 4. **Dashboard** for org admins showing secret exposure across all repos ## Scope ### 1. Secret Detection Engine Built into MokoGitea (not an external tool), scanning: - API keys (AWS, GCP, Azure, Stripe, etc.) - Tokens (GitHub/Gitea personal access tokens, OAuth tokens, JWTs) - Passwords in connection strings (database URLs, SMTP, Redis) - Private keys (SSH, PGP, TLS certificates) - Custom patterns defined at org level Detection uses regex patterns with entropy analysis to reduce false positives. ### 2. Repo Settings Screen Add a **Security** tab in repo settings showing: - Active alerts (secrets found, not yet resolved) - Resolved alerts (acknowledged false positives or rotated secrets) - Scan history (last scan date, commits scanned) - Allow/block list for specific patterns - Toggle for push rejection mode ### 3. Push-Time Scanning On every push (via the pre-receive hook or post-receive processing): - Scan new commits for secrets - If push rejection is enabled: block the push and return an error message explaining which file/line contains the secret - If push rejection is disabled: allow the push but create an alert - Send notification to repo admins ### 4. Org-Level Dashboard Org settings page showing: - Total alerts across all repos - Most common secret types found - Repos with unresolved alerts - Custom pattern management (org-wide regex patterns) ### 5. API - - list alerts - - resolve/dismiss alert - - org-wide alert summary ## Built-In Patterns | Pattern | Example Match | |---------|---------------| | AWS Access Key | | | AWS Secret Key | 40-char base64 after aws_secret | | GitHub/Gitea Token | , , token patterns | | Private Key | | | Generic Password | | | Connection String | | | JWT | | ## Motivation Secret leaks are one of the most common and damaging security incidents. GitHub has this feature built-in. Making it inherent to MokoGitea (not an optional plugin) ensures all repos are protected by default. --- *Authored by Jonathan Miller (@jmiller)*

jmiller changed title from ~~feat(security): built-in secret scanning for repositories~~ to feat(security): built-in security scanning platform for repositories

2026-06-06 21:14:46 +00:00

jmiller commented

2026-06-06 21:14:46 +00:00

Expanded Scope: Full Security Scanning Platform

This is not just secret detection - it is a comprehensive security scanning tool with multiple scanner types:

Scanner Types

Secret Scanner - API keys, tokens, passwords, private keys, connection strings
Dependency Scanner - CVEs in go.mod, package.json, composer.json, requirements.txt
Code Scanner - SQL injection, XSS, command injection, path traversal patterns
Config Scanner - Insecure settings, exposed debug modes, default credentials
License Scanner - License compliance, incompatible license combinations

Architecture

Pluggable scanner framework - each scanner type is a module
Runs on push (post-receive hook) and on-demand
Unified alert storage with severity levels (critical/high/medium/low/info)
Security tab in repo settings showing all findings
Org-level dashboard aggregating across repos
Custom pattern definitions at org level

Authored by Jonathan Miller (@jmiller)

## Expanded Scope: Full Security Scanning Platform This is not just secret detection - it is a comprehensive security scanning tool with multiple scanner types: ### Scanner Types 1. **Secret Scanner** - API keys, tokens, passwords, private keys, connection strings 2. **Dependency Scanner** - CVEs in go.mod, package.json, composer.json, requirements.txt 3. **Code Scanner** - SQL injection, XSS, command injection, path traversal patterns 4. **Config Scanner** - Insecure settings, exposed debug modes, default credentials 5. **License Scanner** - License compliance, incompatible license combinations ### Architecture - Pluggable scanner framework - each scanner type is a module - Runs on push (post-receive hook) and on-demand - Unified alert storage with severity levels (critical/high/medium/low/info) - Security tab in repo settings showing all findings - Org-level dashboard aggregating across repos - Custom pattern definitions at org level --- *Authored by Jonathan Miller (@jmiller)*

jmiller referenced this issue from a commit

2026-06-06 21:23:31 +00:00

feat(security): built-in security scanning platform (#508)

jmiller referenced a pull request that will close this issue

2026-06-06 21:24:06 +00:00

feat(security): built-in security scanning platform (#508) #540

jmiller closed this issue

2026-06-06 21:24:18 +00:00

jmiller referenced this issue from a commit

2026-06-06 21:24:19 +00:00

Merge pull request 'feat(security): built-in security scanning platform (#508)' (#540) from feat/508-security-scanner into dev

jmiller referenced this issue from a commit