/

Secret Scanner Installation

Before you begin

You'll need:

  • A ByteHide account and project token
  • Java 11 or higher installed
  • Node.js 16+ installed (required by the scanner engine)

Installation Options

Choose your preferred installation method:

Download Pre-built JAR

Download the latest bytehide-secrets-scanner.jar from the releases page.

Build from Source

Bash
git clone https://github.com/bytehide/bytehide-secrets-scanner-wrappers.git
cd bytehide-secrets-scanner-wrappers/wrappers/java
mvn clean package

This will create target/bytehide-secrets-scanner.jar.

Basic Setup

After installation, initialize the scanner configuration:

Bash
java -jar bytehide-secrets-scanner.jar init

This interactive command will create a bytehide.secrets.json file in your project root directory:

JSON
{
  "token": "<your-project-token>",
  "appName": "My Java Project",
  "environment": "development",
  "sync": true,
  "fix": false,
  "anonymize": false
}

Security Warning

Never commit your bytehide.secrets.json file to source control. Add it to your .gitignore file.

Verify Installation

After installation, run a scan to verify everything is working:

Bash
java -jar bytehide-secrets-scanner.jar scan

The scanner will automatically:

  1. Check if scanning is enabled for your configuration
  2. Scan source code for secrets
  3. Report any findings to your ByteHide dashboard
  4. Export detected secrets to your ByteHide Secrets Manager (if configured)

Maven Integration

You can integrate the scanner into your Maven build process using the Exec Maven Plugin:

XML
<build>
    <plugins>
        <plugin>
            <groupId>org.codehaus.mojo</groupId>
            <artifactId>exec-maven-plugin</artifactId>
            <version>3.1.0</version>
            <executions>
                <execution>
                    <id>scan-secrets</id>
                    <phase>validate</phase>
                    <goals>
                        <goal>exec</goal>
                    </goals>
                    <configuration>
                        <executable>java</executable>
                        <arguments>
                            <argument>-jar</argument>
                            <argument>${project.basedir}/bytehide-secrets-scanner.jar</argument>
                            <argument>scan</argument>
                            <argument>.</argument>
                        </arguments>
                    </configuration>
                </execution>
            </executions>
        </plugin>
    </plugins>
</build>

Now mvn validate will run the secrets scanner before building.

Gradle Integration

For Gradle projects, add a task to your build.gradle:

Groovy
task scanSecrets(type: Exec) {
    commandLine 'java', '-jar', 'bytehide-secrets-scanner.jar', 'scan', '.'
}

build.dependsOn scanSecrets

Scanner Workflow

The Secret Scanner integrates into your development workflow:

  1. Installation: Download the JAR or build from source
  2. Configuration: Set up the scanner via the JSON file or init command
  3. Scanning: Run manually or automatically during builds
  4. Reporting: Detected secrets appear in your ByteHide dashboard
  5. Action: Export, fix, or receive alerts about found secrets

What's Next?

Previous
Create a project
Next
Configuration