---
title: Configuration
description: Configure Datadog Secret Scanning rules and the files that are scanned.
breadcrumbs: Docs > Datadog Security > Code Security > Secret Scanning > Configuration
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Configuration

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

By default, Datadog Secret Scanning scans enabled repositories with all [rules in the Secrets & Credentials category of Sensitive Data Scanner](https://docs.datadoghq.com/security/sensitive_data_scanner/scanning_rules/library_rules.md?category=Secrets+and+credentials). You can customize which rules run, modify default rules, and create custom rules on the [Code configuration page](https://app.datadoghq.com/sensitive-data-scanner/configuration/code) in SDS.

The rules, scanning groups, and custom rules described on this page are configured in Datadog. A configuration file in your repository adds separate control over which files are scanned. See File configuration.

## Scanning groups{% #scanning-groups %}

There are two scanning groups that configure Secret Scanning rules.

### Managed scanning group{% #managed-scanning-group %}

The managed scanning group is managed by Datadog's security team. It automatically receives new rules and updates to rules, and is enabled by default for all organizations.

{% image
   source="https://docs.dd-static.net/images/code_security/secret_scanning/managed_scanning_group_not_customized.ffdd6ecb704c17a730d6c601ee17c20e.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/code_security/secret_scanning/managed_scanning_group_not_customized.ffdd6ecb704c17a730d6c601ee17c20e.png?auto=format&fit=max&w=850&dpr=2 2x"
   alt="Managed scanning group" /%}

### Custom rule scanning group{% #custom-rule-scanning-group %}

The custom scanning group is managed by user orgs. You can [create and test custom regex rules](https://docs.datadoghq.com/security/sensitive_data_scanner/scanning_rules/custom_rules.md) or add rules from the SDS rules library.

{% image
   source="https://docs.dd-static.net/images/code_security/secret_scanning/custom_scanning_group.a824a6f4a46de08c676e69d86f2d1a52.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/code_security/secret_scanning/custom_scanning_group.a824a6f4a46de08c676e69d86f2d1a52.png?auto=format&fit=max&w=850&dpr=2 2x"
   alt="Custom scanning group" /%}

## Configuring rules{% #configuring-rules %}

### Customizing default rules{% #customizing-default-rules %}

To customize the severity and keywords of a managed default rule, hover over the rule and click the pencil icon on the right.

{% image
   source="https://docs.dd-static.net/images/code_security/secret_scanning/customize_default_rule.254872b20310138ae05a2e4c064e4f40.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/code_security/secret_scanning/customize_default_rule.254872b20310138ae05a2e4c064e4f40.png?auto=format&fit=max&w=850&dpr=2 2x"
   alt="Edit rule" /%}



The edit dialog opens.

{% image
   source="https://docs.dd-static.net/images/code_security/secret_scanning/configure_default_rule.809c3ee9e289c2616737c8ec8d498d5c.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/code_security/secret_scanning/configure_default_rule.809c3ee9e289c2616737c8ec8d498d5c.png?auto=format&fit=max&w=850&dpr=2 2x"
   alt="Edit rule popup" /%}



After editing the rule and clicking Update at the bottom right, the modified rule appears as Customized in the managed scanning group.

{% image
   source="https://docs.dd-static.net/images/code_security/secret_scanning/disable_rule.0fd0c1f4a4126ddcdc1ceeb733279389.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/code_security/secret_scanning/disable_rule.0fd0c1f4a4126ddcdc1ceeb733279389.png?auto=format&fit=max&w=850&dpr=2 2x"
   alt="Customized secret scanning rule in managed group" /%}

{% alert level="info" %}
Customized rules do not automatically receive severity/default keyword updates from Datadog's security team. To restore a rule to its managed state, hover over a customized rule and click the restore icon at the right.
{% /alert %}

### Creating custom rules{% #creating-custom-rules %}

To create a custom rule, go to the custom scanning group and click Add scanning rule at the bottom or Add rule at the top right. Create your regex rule, then configure the severity and keywords. After they're enabled, your repositories are scanned with the new rules on the next commit.

{% image
   source="https://docs.dd-static.net/images/code_security/secret_scanning/add_to_custom.a735f3c148bfaeead5ff687067599c29.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/code_security/secret_scanning/add_to_custom.a735f3c148bfaeead5ff687067599c29.png?auto=format&fit=max&w=850&dpr=2 2x"
   alt="Add rule to custom group" /%}

To update a custom rule, hover over the rule and click the pencil icon on the right.

### Disabling rules{% #disabling-rules %}

Disable a rule by clicking the blue toggle on the right.

{% alert level="info" %}
After a specific rule is disabled, existing findings from that rule are auto-closed in Secret Scanning on the next commit.
{% /alert %}

## File configuration{% #file-configuration %}

Rules are configured in Datadog as described in the Configuring rules section. Which files Secret Scanning reads is configured under the `secrets` key in the Code Security configuration. Define it in Datadog, or in a `code-security.datadog.yaml` file at the root of your repository.

For information on configuration locations, precedence, and merging, see [Code Security Configuration Reference](https://docs.datadoghq.com/security/code_security/guides/configuration.md).

The configuration must begin with `schema-version: v1.5`, followed by a `secrets` key containing a `global-config` object. The `global-config` object controls repository-wide settings:

| **Property**             | **Type** | **Description**                                                          | **Default** |
| ------------------------ | -------- | ------------------------------------------------------------------------ | ----------- |
| `only-paths`             | Array    | File paths or glob patterns. Only matching files are analyzed.           | None        |
| `ignore-paths`           | Array    | File paths or glob patterns to exclude. Matching files are not analyzed. | None        |
| `use-gitignore`          | Boolean  | Whether to include entries from the `.gitignore` file in `ignore-paths`. | `true`      |
| `ignore-generated-files` | Boolean  | Whether to include common generated file patterns in `ignore-paths`.     | `true`      |
| `max-file-size-kb`       | Number   | Maximum file size (in kB) to analyze. Larger files are ignored.          | `10240`     |

### Example configuration{% #example-configuration %}

```yaml
schema-version: v1.5
secrets:
  global-config:
    # Only analyze the following paths/files
    only-paths:
      - "src"
      - "**/*.py"
    # Do not analyze the following paths/files
    ignore-paths:
      - "tests"
      - "**/*.lock"
    use-gitignore: true
    ignore-generated-files: true
    max-file-size-kb: 10240
```