Developers paste API keys into Jira every day. SecretSentry catches them there: it scans every issue and comment for leaked secrets, flags them in the issue panel, and lets a Rovo agent answer "what leaked in this project?" — all without a single byte leaving Atlassian.
SecretSentry finds leaked secrets where developers actually discuss work: in Jira. API keys, tokens, passwords, and private keys end up in Jira tickets all the time — in an issue description, in a "try this key" comment, in a pasted error log. Once a secret is in Jira it spreads to search indexes, exports, and screenshots, and teams usually only notice after the credential is abused. Existing secret scanners run in repos and CI, not where people talk. SecretSentry closes that gap, as a native Forge app: - Automatic scanning. Every time an issue is created, updated, or commented on, a Forge trigger scans its description and comments. A daily re-scan catches edits the trigger missed and re-scores findings if detection patterns change. - Deterministic detection. Known-format patterns (AWS Access Key and Secret Key, GitHub Personal Access and OAuth tokens, Slack tokens, private keys, generic API keys and passwords) plus a Shannon-entropy heuristic for long random tokens no known pattern covers. Each finding carries a severity (CRITICAL / HIGH / MEDIUM / LOW), a location (description or comment, with line number), and a redacted preview. - Issue panel. Findings appear directly in the Jira issue panel, with severity, last-scan time, and a "Scan again" button. - Rovo agent. Ask in chat: "Are there any leaked secrets in this project?" The SecretSentry agent answers from three read-only actions (scan-issue, get-findings, list-project-findings) and is prompted never to show, repeat, or reconstruct a secret value. Security is the product, not a feature: Findings store only a redacted preview — the first 4 and last 4 characters (AKIA...MPLE). Full secret values are never stored, never shown, and never sent to the agent. Zero egress: the app declares no external fetch permission, so it cannot call any outside API. Secrets never leave Atlassian's platform. Least privilege: only read:jira-work and storage:app scopes. The deployed version is eligible for the Runs on Atlassian program. Verified live on Jira Cloud: a fake GitHub token was flagged CRITICAL — GitHub Personal Access Token, description line 1, preview ghp_...AAAA; a fake AWS key was auto-scanned on issue creation (CRITICAL, AKIA...MPLE); a fake Slack token on line 3 of a 4-line description was flagged HIGH on line 3 (xoxb...IJKL). Findings persisted across reloads, while a clean issue correctly shows "No leaked secrets found". Only fake/test secrets were used for testing.
Built With
- forge
- javascript
- jira
- node.js
- rovo
- secret-scanning
- security
- ui-kit
