@sanity-labs/backstage-plugin-secret-scanning

Shows open GitHub secret-scanning alerts for an entity's repository.

Requires @sanity-labs/backstage-plugin-secret-scanning-backend, which does the org-wide sweep and the filtering.

The credential never reaches the browser

The backend projects away the raw credential and its location before responding, so this card only ever holds the alert's type, validity, exposure, age and its GitHub URL. Every row links out to the alert in GitHub — that is where the credential stays.

Installation

// packages/app/src/components/catalog/EntityPage.tsx
import { EntitySecretScanningCard } from '@sanity-labs/backstage-plugin-secret-scanning';

<Grid item md={6} xs={12}>
  <EntitySecretScanningCard />
</Grid>;

The card brings its own react-query client, so no provider wiring is needed.

Entity annotation

metadata:
  annotations:
    github.com/project-slug: sanity-io/kong

Without the annotation the card renders a "not configured" state rather than an error.

What it renders

The card uses GitHub's own model so the words match the repository Security tab: validity is the axis, and GitHub's two alert labels sit orthogonal to it.

Counts by validity state, worst first — every open alert is exactly one of these:

| State (GitHub's wording) | Meaning | | ------------------------ | ------------------------------------------------------------------ | | Active secret | GitHub checked with the provider and the secret is active | | Potentially active secret | GitHub cannot validate this token type, or could not verify it | | Secret inactive | GitHub checked and the secret is inactive — confirm no prior use |

States holding alerts get an emphasised tile; states at zero recede into a quiet strip, so the usual "one number" case reads as one number.

Then GitHub's alert labels, counted separately because they overlap the states:

| Label | Meaning | | ------------ | -------------------------------------------------------------------------- | | public leak | The same secret was also found by GitHub's scans of public code, gists, issues, pull requests and wikis | | multi-repo | The same secret was found in other repositories in the organization |

Labels are only rendered when present. GitHub runs public-leak detection on provider-based patterns only, so a missing label often means "not evaluated" — showing a zero would read as a negative finding it is not.

Then one row per alert with its type, any labels it carries, creation date and a link to the alert, grouped under its validity state when the alerts span more than one. Most services have no open alerts, so that case gets its own deliberate "nothing open" panel rather than an empty table.

Configuration

Both keys are optional; the backend already caches the org sweep on a TTL.

secretScanning:
  # Minutes before the card refetches (default: 5)
  staleTime: 5
  # Minutes an unused report stays in the query cache (default: 30)
  gcTime: 30

Development

yarn workspace @sanity-labs/backstage-plugin-secret-scanning start

Renders the populated, empty and not-configured states against fixtures — no GitHub token needed.