Secret Sentinel – Leak Scanner for Jira & Confluence

• Install for Confluence
• Install for Jira
• Features
• Try the safe scanner lab
• Review the regression benchmark
• Compare architectures and alternatives
• What it detects
• Editions: Standard and Advanced
• Benefits
• How it works
• Get started

What is Secret Sentinel?

Secret Sentinel is a security automation app for Atlassian Confluence and Jira that continuously scans your content for leaked credentials — passwords, API keys, tokens, private keys, and database connection strings — and redacts them automatically, before they turn into a breach.

Secret Sentinel is delivered as two separate Forge apps:

• Secret Sentinel for Confluence – protects Confluence pages and comments
• Secret Sentinel for Jira – protects Jira work items and comments

Each app works independently within its product. Optionally, either product’s detections can create Jira security incidents (requires installing both apps on the same Atlassian site).

Built entirely on Atlassian Forge. No external services. No environment variables. No data ever leaves your Atlassian instance.

Both apps carry Atlassian’s Runs on Atlassian badge. Review the exact data flow, requested scopes, stored fields, retention, and product limitations in the Secret Sentinel Trust Center, or use the admin approval kit for a sandbox installation request.

Want to inspect behavior before installing? The safe Secret Scanner Lab shows verified Jira and Confluence fixtures with their precomputed classifications and redactions. It accepts no user content and exposes no production scanner code.

For broader regression evidence, the public benchmark reports aggregate results from the private automated corpus without publishing fixtures, test names, paths, rules, or scanner code. CI-generated reports are accompanied by a Sigstore verification bundle.

Making a product or architecture decision? Use the evidence-backed comparison guides for Jira Automation, DLP, Forge Remote, repository scanning, Jira versus Confluence, and Standard versus Advanced. Each guide records its sources, review date, and claim boundary.

Features

• Broad, enterprise-grade detection coverage
  Scans for 50+ credential types across major cloud providers, CI/CD tools, databases, and SaaS platforms — see What it detects below. Built on secretlint, a maintained open-source secret-scanning engine, not a closed, unauditable pattern list — plus a few real leak shapes we cover ourselves on top of it, like bare JWTs and AWS identifiers, where the library alone leaves a gap.

• Safe, in-place redaction
  Secrets are replaced directly inside Confluence pages, comments, inline comments, Jira work item titles, descriptions, and comments — formatting is preserved, nothing else is touched.

• Risk-based severity, not just keyword matching
  Every finding is classified by real exploitability — a live, usable secret key is treated differently from a bare identifier that’s harmless without its paired secret — so security teams see fewer, more meaningful alerts.

• Jira incident escalation (optional)
  High-risk leaks can automatically open a Jira security incident — configurable project, issue type, priority, and default assignee — for tracking, credential rotation, and remediation.

• Fine-grained enterprise controls, not one-size-fits-all
  Override severity and escalation per credential type, exclude specific Confluence spaces, Jira projects, or comments from ever creating an incident, and mark specific known-safe values (e.g. documentation placeholders) as permanently ignored — every override is auditable and redaction is never affected, only which findings escalate.

• Compliance dashboard (Advanced edition)
  Aggregated, always-on-hand reporting of detection counts by credential type, severity, and month — built for security and compliance teams who need to demonstrate ongoing monitoring without digging through incident history.

• Custom regex patterns (Advanced edition)
  Detect credential formats specific to your own organization — an internal API key prefix, a proprietary token shape — with admin-defined regular expressions, evaluated by a linear-time (ReDoS-safe) regex engine so a pattern can never hang a scan.

• Confluence and Jira support
  Available as separate apps for Confluence and Jira, with independent configuration per product, and cross-product escalation when both are installed.

• Enterprise-ready Forge architecture
  Runs fully inside Atlassian’s infrastructure with no external services, no data exfiltration, and no environment variables — backed by a rigorously tested codebase (370+ automated scenario tests covering detection, redaction, and escalation behavior).

What it detects

Secret Sentinel scans for 50+ credential and secret types across the services your teams actually use:

Every finding is classified by actual risk — a paired AWS secret key is treated as a critical, high-severity leak; a bare identifier that isn’t exploitable on its own is flagged at lower severity — so escalation stays proportionate to real risk instead of flooding your team with low-value alerts.

Most of this is secretlint’s own detection — but not all of it. JWTs aren’t covered by any rule in secretlint’s ruleset, and a bare AWS access key ID or account ID (no paired secret) is intentionally not flagged by secretlint’s own defaults, since neither is exploitable alone. Secret Sentinel adds both as its own, tested detections layered on top of the library, at a correspondingly lower severity than a real paired credential — worth catching, without treating it as equivalent to an actual leak.

See the documentation for a full copy-paste example you can run yourself — including a version that exercises all 50+ of these types end to end in one paste.

Editions: Standard and Advanced

Secret Sentinel is available in two editions:

Standard includes full detection and redaction coverage across all 50+ credential types, risk-based Jira incident escalation, and every enterprise-tuning control: per-credential-type severity and escalation overrides, an escalation exclude list (skip specific Confluence spaces, Jira projects, or comments), and a custom per-value ignore list for known-safe strings like documentation placeholders.

Advanced adds two enterprise-focused capabilities on top of Standard:

• Compliance dashboard — aggregated detection counts by credential type, severity, and month, always available for security and compliance reporting without manual log digging.
• Custom regex patterns — admin-defined detection rules for credential formats specific to your organization, evaluated by a linear-time (ReDoS-safe) regex engine so a custom pattern can never hang a scan.

Redaction and Jira escalation behavior are identical on both editions — Advanced only unlocks additional visibility and customization, never a difference in what gets protected.

Benefits

With Secret Sentinel, teams can:

• Prevent credential leaks before they cause incidents
• Eliminate manual secret cleanup in Confluence and Jira
• Enforce consistent security hygiene across teams, across 50+ credential types
• Cut alert fatigue with severity classification based on real exploitability, not keyword matching
• Tune escalation to your organization’s structure — per credential type, per space/project, or per known-safe value — without ever weakening redaction itself
• Give security and compliance teams an always-on-hand view of detection activity with the compliance dashboard (Advanced)
• Extend detection to your own organization’s credential formats with custom regex patterns (Advanced)
• Respond faster to high-risk leaks using existing Jira workflows
• Stay compliant without sending data to third-party services — everything runs inside Atlassian’s own infrastructure

How it works

1. Content is created or updated in Confluence or Jira
2. Secret Sentinel scans the content automatically
3. Each finding is classified by severity — a real, exploitable secret versus a low-risk identifier
4. Detected secrets are safely redacted in place
5. If enabled, high-risk leaks automatically create a Jira security incident for tracking and remediation

All processing happens inside Atlassian infrastructure — nothing is sent to a third-party service.

Research and practical guides

• How to Prevent Credential Leaks in Confluence and Jira
• Common Types of Leaked Credentials
• Why .env Files Are a Security Risk
• Offboarding: The Access Nobody Remembers to Revoke
• What to Check Before Installing an Atlassian Marketplace App
• A Practical Guide to Rotating Credentials After a Leak
• Why Private Repositories Still Leak Secrets
• Secret Scanner Accuracy: Precision Is Not Enough
• Zero Trust Stops at the Confluence Page
• Deleting a Leaked Secret Does Not Revoke It
• The Secret Lifecycle Your Jira Workflow Is Missing
• Data Egress Is the Hidden Risk in Atlassian Security Apps
• Per-Secret Encryption Makes Git Reviews Safer
• AI Coding Assistants and the Secret-Sprawl Curve
• A Secrets Manager Does Not Stop Secret Sprawl
• A Two-Layer Secret Defense for Git and Atlassian
• Secrets in Jira Issues: What the Research Found
• Why Training Alone Does Not Prevent Secret Leaks
• How Secret Sentinel Detects Secrets: An Open Methodology
• DLP for Confluence: What Atlassian’s Native Tool Covers — and What It Doesn’t
• Preventing Sensitive Data Leaks in Confluence and Jira
• SOC 2 and Your Confluence/Jira Data: What Auditors Actually Look For

Evaluation resources

• Jira scanner admin checklist
• GitHub vs Jira secret scanning
• How to build an app approval case
• How to test detection without live credentials
• How to Evaluate a PII or Secret Scanner for Confluence and Jira

Get started

Protect your Confluence and Jira content from credential leaks in minutes.

• Install Secret Sentinel for Confluence
• Install Secret Sentinel for Jira