<p>I resolved the issue by adding a comment containing <code>pragma: allowlist secret</code> in the offending line.</p>
<p>I didn't try it at first, because the issue was in an <code>appsettings.json</code> file of an asp.net project and according to Google json can't have comments. However, seems like Microsoft does allow <code>//</code> comments in <code>appsettings.json</code>.</p>

CC BY-SA 4.0
2024-03-14T07:56:37.720Z
2024-03-14T07:56:37.720Z
Louis Cloete
<p>detect-secrets-hook in my pre-commit is alerting on secrets that are already marked as safe to be committed in the baseline.</p>
<p>I'm running detect-secrets version 1.4.0 on Python 3.11.0 on Windows 11.</p>
<p>To reproduce:</p>
<ol>
<li>Have a file in a git repo containing something that will get caught as a secret. Update something in the file so that it needs to be committed.</li>
<li>Create/recreate a secrets baseline with <code>detect-secrets scan &gt; .secrets.baseline</code></li>
<li>Resave the baseline file as UTF-8, <a href="https://github.com/Yelp/detect-secrets/issues/272" rel="nofollow noreferrer">because I'm on Windows</a>.</li>
<li>Run <code>detect-secrets audit .secrets.baseline</code> and accept that the secret is okay to be in the file. The segment of the baseline file looks like:</li>
</ol>
<pre><code>&quot;results&quot;: {
    &quot;xyz\\dev_local_settings.py&quot;: [
      {
        &quot;type&quot;: &quot;Secret Keyword&quot;,
        &quot;filename&quot;: &quot;xyz\\dev_local_settings.py&quot;,
        &quot;hashed_secret&quot;: &quot;62f4d1d18d106c8e6f3c79df832893f4b6e95c8e&quot;,
        &quot;is_verified&quot;: false,
        &quot;line_number&quot;: 26,
        &quot;is_secret&quot;: false
      }
    ]
  },
</code></pre>
<ol start="5">
<li>Have a pre-commit config that looks like this:</li>
</ol>
<pre><code>repos:
-   repo: https://github.com/Yelp/detect-secrets
    rev: v1.4.0
    hooks:
    -   id: detect-secrets
        args: ['--baseline', '.secrets.baseline']
        exclude: package.lock.json
</code></pre>
<ol start="6">
<li>Attempt to <code>git commit -a</code>.</li>
</ol>
<p>The pre-commit check will fail on the one known secret:</p>
<pre><code>Detect secrets...........................................................Failed
- hook id: detect-secrets
- exit code: 1

ERROR: Potential secrets about to be committed to git repo!


Secret Type: Secret Keyword
Location:    xyz/dev_local_settings.py:26
</code></pre>
<ol start="7">
<li>Another run of <code>detect-secrets audit .secrets.baseline</code> yields &quot;Nothing to audit!&quot;</li>
</ol>
<p>Am I misunderstanding how detect-secrets works? I would expect it to not alert on a secret that was marked as safe in the baseline.</p>

CC BY-SA 4.0
2024-03-13T07:42:35.407Z
did you resolve your issue? I'm having the exact same issue.
Louis Cloete
<security><devsecops>
Why is detect-secrets-hook ignoring my audit selections?
Melissa Avery-Weir
# Why is detect-secrets-hook ignoring my audit selections?

(Asked by: username_0 on 2023-04-16)

detect-secrets-hook in my pre-commit is alerting on secrets that are already marked as safe to be committed in the baseline.
I'm running detect-secrets version 1.4.0 on Python 3.11.0 on Windows 11.
To reproduce:

Have a file in a git repo containing something that will get caught as a secret. Update something in the file so that it needs to be committed.
Create/recreate a secrets baseline with detect-secrets scan > .secrets.baseline
Resave the baseline file as UTF-8, because I'm on Windows.
Run detect-secrets audit .secrets.baseline and accept that the secret is okay to be in the file. The segment of the baseline file looks like:

"results": {
    "xyz\\dev_local_settings.py": [
      {
        "type": "Secret Keyword",
        "filename": "xyz\\dev_local_settings.py",
        "hashed_secret": "62f4d1d18d106c8e6f3c79df832893f4b6e95c8e",
        "is_verified": false,
        "line_number": 26,
        "is_secret": false
      }
    ]
  },


Have a pre-commit config that looks like this:

repos:
-   repo: https://github.com/Yelp/detect-secrets
    rev: v1.4.0
    hooks:
    -   id: detect-secrets
        args: ['--baseline', '.secrets.baseline']
        exclude: package.lock.json


Attempt to git commit -a.

The pre-commit check will fail on the one known secret:
Detect secrets...........................................................Failed
- hook id: detect-secrets
- exit code: 1

ERROR: Potential secrets about to be committed to git repo!


Secret Type: Secret Keyword
Location:    xyz/dev_local_settings.py:26


Another run of detect-secrets audit .secrets.baseline yields "Nothing to audit!"

Am I misunderstanding how detect-secrets works? I would expect it to not alert on a secret that was marked as safe in the baseline.

**Tags:** security, devsecops

> **Comments:**
> **username_1**: did you resolve your issue? I'm having the exact same issue.  

---

## 1 answers

### Answer by username_1 on 2024-03-14. Score: 0

I resolved the issue by adding a comment containing `pragma: allowlist secret` in the offending line.

I didn't try it at first, because the issue was in an `appsettings.json` file of an asp.net project and according to Google json can't have comments. However, seems like Microsoft does allow `//` comments in `appsettings.json`.


---

