Overview

A discovery plugin that identifies cryptographic assets (secrets, certificates, API keys, and credentials) within container images through the Qualys Container Security API.

This plugin discovers secrets in container images by querying the Qualys Container Security API. It returns detected secrets with:

• Unique identifiers (URNs) - Content-based fingerprints combining secret type, source layer, file location, and line number
• Extrinsic locators (URLs) - Registry-aware URLs pointing to the container image or local image location
• Metadata - Secret category, severity, detection rules, layer information, and timestamp information

Features

The plugin supports discovery across multiple container registries, including but not limited to:

• Docker Hub - Public and private Docker registries
• Docker V2 - Docker Registry API v2 compatible registries
• Docker V2-Private - Docker V2 registries with private/authentication requirements
• AWS ECR - Amazon Elastic Container Registry
• Azure Container Registry - Azure container registry service
• GitHub Container Registry - GitHub Packages container registry
• Google Artifact Registry - Google Cloud artifact repositories
• Google Cloud Registry - Legacy Google Container Registry (GCR)
• Harbor Container Registry - Enterprise container registry
• JFrog Artifactory Private - JFrog Artifactory container registry
• Red Hat Quay - Red Hat Quay container registry