Products & Technology

Improve secret scanning efficiency in HCP Vault Radar

Learn how HCP Vault Radar uses tuning detection with regex, ignore rules, and exclusion rules to detect leaks and unmanaged secrets.

May 01 2025Rich DuBose, Chandni Patel, Siranjeevi Dheenadhayalan

As businesses continue to embrace the cloud, the importance of securing sensitive data and secrets increases exponentially. Secrets management is a critical part of an organization's security strategy to safeguard sensitive information such as API keys, database credentials, private keys, and other confidential assets. HashiCorp Vault, an industry standard in secrets management, offers a suite of tools to help enterprises manage these secrets securely, and one of the key pieces of the Vault ecosystem is HCP Vault Radar.

HCP Vault Radar detects secret leaks and identifies unmanaged secrets that might inadvertently be exposed during development or deployment. But as with any security tool, fine-tuning its detection capabilities to avoid false positives and false negatives is crucial.

In this blog, we will delve into how HCP Vault Radar works, how it detects secret leaks, and how you can configure it using regex, global ignore rules, repository-specific ignore rules, and exclusion rules to get the most accurate and actionable results.

»How does Vault Radar detect leaks?

Vault Radar works by analyzing the contents of code repositories and collaboration platforms to identify patterns that match secret formats. It relies on sophisticated scanning techniques and pattern recognition to identify potential secrets. However, identifying a "secret" is not always as straightforward as it seems. Secrets can come in many forms, including:

Base64 encoded strings which could represent tokens or credentials.
UUIDs or GUIDs which might be used as API keys.
Hexadecimal strings which could be private keys or other sensitive data.
Common vendor secret patterns could include AWS secret access keys, GitHub tokens, or database passwords.

Context is also important. Some factors to look at include:

Heuristic-context pattern recognition and predefined rules, which are used to identify potentially compromised credentials, anomalies, or known indicators, without relying solely on exact matches.
Entropy-factor based detection, which analyzes randomness or unpredictability of data, flagging credentials with unusually high entropy as potentially compromised due to their complexity or irregular patterns.

To detect these leaks, Vault Radar uses a combination of built-in detection rules based on common formats for secrets and machine learning models. However, it’s important to remember that not all of these patterns will be relevant in every project. For instance, a UUID might be a regular identifier in one project, but it could be a secret key in another. This is where tuning Vault Radar becomes essential to minimize false positives and ensure that the right secrets are flagged.

»Tuning Vault Radar detection with regular expressions

Regular expressions (regex) are a powerful tool for customizing detection rules and fine-tuning the accuracy of secret detection in Vault Radar. Regex allows you to define specific patterns for secrets that might not be caught by the default rules.

For example, let’s say your application uses a custom token format or an unconventional secret pattern that Vault Radar’s default detection doesn't capture. With regex, you can define your own custom pattern to catch these secrets.

»Custom regex for API keys

Suppose your company uses API keys that follow a custom format like apikey-xyz123-abc456. A default detection rule might miss this format. However, you can create a custom regex pattern like this:

apikey-[a-zA-Z0-9]{6}-[a-zA-Z0-9]{6}

This regex will match any string that follows the specific apikey-xxxxxx-xxxxxx pattern. By adding this regex to the Vault Radar configuration, you can ensure that these keys are detected and flagged during the scanning process.

»Ignoring UUIDs globally

The regex pattern for a UUID is usually something like this:

\b[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\b

By adding this pattern to the global ignore rule, Vault Radar will skip scanning any string that matches the UUID format across all repositories.

»Excluding a directory with mock data

If you have a directory called mock-data/ that contains test data, you can define an exclusion rule to prevent Vault Radar from scanning the files inside this directory. This helps prevent Vault Radar from flagging mock data that is intentionally not sensitive.

To exclude a directory, you can define an exclusion rule like this:

^mock-data/

This tells Vault Radar to completely ignore the contents of the mock-data directory.

»Ignoring development tokens in a specific repository

Suppose you have a repository dedicated to development purposes that contains non-sensitive API keys. You can create repository-specific ignore rules to ensure that these keys are not flagged as secrets. This could be useful if the repository includes mock keys or environment-specific tokens that are safe for public exposure.

For example, you might define an ignore rule to exclude the dev-api-key pattern from being flagged:

dev-api-key-[a-zA-Z0-9]{10}

This regex rule ensures that any API keys with the prefix dev-api-key- are ignored only in this repository.

Creating custom regex rules in HCP Vault Radar project settings

To implement custom regex in Vault Radar, you typically update the configuration file or interface where detection rules are defined. Once added, these regex patterns will work alongside the default rules to identify secrets with greater precision.

»Global ignore rules

In many scenarios, there are certain types of data or files that might frequently be detected as secrets but aren’t actually sensitive or shouldn't be flagged. For example, a UUID might be used as a regular identifier in your application, or a specific string pattern might appear in test data files, but they’re not actual secrets.

Vault Radar enables users to configure global ignore rules to manage the detection of sensitive data across multiple data sources. These rules make Vault Radar ignore specific paths, files, secret values, secret types, or resources based on predefined patterns or regular expressions. The global ignore rules are applied to future scans, ensuring that events matching these rules are marked with a severity level of "INFO" and flagged as "Not important." This feature helps streamline data management by reducing unnecessary alerts, particularly in high-volume environments. Additionally, it provides flexibility to fine-tune which types of events should be ignored for different resources or data types.

Global ignore rules example

Configurable global ignore rules include:

To define global ignore rules in Vault Radar, you can add the patterns to the global settings section within the Vault Radar configuration file or UI.

»Repository-specific ignore rules

While global ignore rules apply to all repositories, there are situations where certain repositories require custom ignore rules due to specific code patterns or data structures. For instance, some repositories might intentionally include secrets that are not sensitive (e.g. API keys for a public service or local development configurations).

Vault Radar lets you define repository-specific ignore rules to fine-tune detection on a per-repository basis. These rules tell Vault Radar to ignore certain patterns that are specific to the context of a particular project, without affecting the scanning of other repositories in your organization.

Connecting a data source

Vault Radar also allows users to write custom ignore rules inline by adding the comment HashiCorpIgnore, a feature that helps streamline the process of managing sensitive data and configurations. By leveraging comments in code (e.g. #HashiCorpIgnore), developers can specify patterns or conditions to exclude certain secrets, paths, or data from being scanned or monitored by Vault Radar.

This provides greater flexibility and control, enabling teams to avoid unnecessary alerts or prevent the scanning of specific resources that are not relevant to security or compliance checks. Inline ignore rules can be tailored to meet organizational needs, ensuring that only the necessary data is under scrutiny while reducing noise and improving operational efficiency.

resource "test_db_instance" "database" {
  allocated_storage = 5
  engine            = "mysql"
  instance_class    = "db.t2.micro"
  username          = "demo-admin"
  password          = "notasecurepassword" # HashiCorpIgnore

»Exclusion rules for specific files or directories

In some cases, you might want to exclude entire files or directories from being scanned. This is especially useful when you have known files that contain non-sensitive data or temporary configurations that could lead to false positives.

Vault Radar allows you to define exclusion rules, specifying which files or directories to exclude from scanning. This can reduce noise in the detection results and ensure that Vault Radar focuses only on relevant code and data.

»Vault correlation

Vault correlation in Vault Radar allows users to connect their HCP Vault Dedicated or Enterprise cluster to the Vault Radar agent, enabling the correlation of findings with the secrets stored in Vault. This integration helps identify secrets that need to be rotated by linking the findings from Vault Radar scans to the actual secrets managed within Vault.

Integrating Vault correlation into Vault Radar offers significant benefits for organizations by enhancing their ability to reduce risk and improve overall security posture. By accurately correlating security findings with actual secrets stored in Vault, organizations can quickly identify and address exposed or outdated credentials, minimizing the potential for unauthorized access or breaches.

Additionally, by minimizing false positives through more precise and context-aware scanning, operational costs are reduced, as security teams can focus on genuine threats rather than sifting through unnecessary alerts. This efficiency also improves the overall security workflow, enabling faster response times and a more streamlined security process.

»Best practices for tuning Vault Radar detection

Here are some best practices for fine-tuning detection in Vault Radar:

Use regex for custom patterns: If your secrets use non-standard formats, define custom regex patterns to detect them.
Avoid overuse of ignore rules: While ignore and exclusion rules are helpful, overusing them can result in missing real secrets. Only apply ignore rules when absolutely necessary.
Test changes: After applying new rules (regex, ignore, or exclusion), test the changes in a staging environment before rolling them out across production repositories.
Monitor false positives: Regularly monitor and review false positives, and adjust rules as needed to keep the scanning results accurate.
Document rules: Keep clear documentation of the rules you have implemented, so other team members can understand and maintain them.
Connect your Vault secrets manager: Leverage Vault Enterprise or HCP Vault Dedicated to identify leaked credentials that are also active secrets.

»Vault and Vault Radar: A powerful combo

As the developer community increasingly adopts cloud technologies for things ranging from passion projects to production deployments, safeguarding sensitive data and secrets becomes paramount. For developers and security teams, secrets management is a critical aspect of protecting that sensitive information. HashiCorp Vault is a battle-tested secrets management platform, and HCP Vault Radar is a powerful addition for detecting secret leaks and managing secrets in code repositories.

By understanding how Vault Radar works and using techniques like regex, global ignore rules, repository-specific ignore rules, and exclusion rules, enterprises can ensure that their secret scanning is both accurate and efficient. With careful tuning, organizations can effectively minimize false positives and false negatives while maintaining robust security and compliance with data protection regulations. By proactively managing secrets and leaks, Vault Radar helps reduce the risks of data breaches, unauthorized access, and potential vulnerabilities in your cloud-native environments.