asafc.sarif

{
  "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
  "version": "2.1.0",
  "runs": [
    {
      "tool": {
        "driver": {
          "informationUri": "https://jfrog.com/help/r/jfrog-security-documentation/jfrog-advanced-security",
          "name": "JFrog Secrets scanner",
          "rules": [
            {
              "id": "REQ.SECRET.GENERIC.TEXT",
              "name": "REQ.SECRET.GENERIC.TEXT",
              "shortDescription": {
                "text": "Scanner for REQ.SECRET.GENERIC.TEXT"
              },
              "fullDescription": {
                "text": "Storing hardcoded secrets in your source code or binary artifact could lead to several risks.\n\nIf the secret is associated with a wide scope of privileges, attackers could extract it from the source code or binary artifact and use it maliciously to attack many targets. For example, if the hardcoded password gives high-privilege access to an AWS account, the attackers may be able to query/modify company-wide sensitive data without per-user authentication.\n\n## Best practices\n\nUse safe storage when storing high-privilege secrets such as passwords and tokens, for example -\n\n* ### Environment Variables\n\nEnvironment variables are set outside of the application code, and can be dynamically passed to the application only when needed, for example -\n`SECRET_VAR=MySecret ./my_application`\nThis way, `MySecret` does not have to be hardcoded into `my_application`.\n\nNote that if your entire binary artifact is published (ex. a Docker container published to Docker Hub), the value for the environment variable must not be stored in the artifact itself (ex. inside the `Dockerfile` or one of the container's files) but rather must be passed dynamically, for example in the `docker run` call as an argument.\n\n* ### Secret management services\n\nExternal vendors offer cloud-based secret management services, that provide proper access control to each secret. The given access to each secret can be dynamically modified or even revoked. Some examples include -\n\n* [Hashicorp Vault](https://www.vaultproject.io)\n* [AWS KMS](https://aws.amazon.com/kms) (Key Management Service)\n* [Google Cloud KMS](https://cloud.google.com/security-key-management)\n\n## Least-privilege principle\n\nStoring a secret in a hardcoded manner can be made safer, by making sure the secret grants the least amount of privilege as needed by the application.\nFor example - if the application needs to read a specific table from a specific database, and the secret grants access to perform this operation **only** (meaning - no access to other tables, no write access at all) then the damage from any secret leaks is mitigated.\nThat being said, it is still not recommended to store secrets in a hardcoded manner, since this type of storage does not offer any way to revoke or moderate the usage of the secret.\n",
                "markdown": "Storing hardcoded secrets in your source code or binary artifact could lead to several risks.\n\nIf the secret is associated with a wide scope of privileges, attackers could extract it from the source code or binary artifact and use it maliciously to attack many targets. For example, if the hardcoded password gives high-privilege access to an AWS account, the attackers may be able to query/modify company-wide sensitive data without per-user authentication.\n\n## Best practices\n\nUse safe storage when storing high-privilege secrets such as passwords and tokens, for example -\n\n* ### Environment Variables\n\nEnvironment variables are set outside of the application code, and can be dynamically passed to the application only when needed, for example -\n`SECRET_VAR=MySecret ./my_application`\nThis way, `MySecret` does not have to be hardcoded into `my_application`.\n\nNote that if your entire binary artifact is published (ex. a Docker container published to Docker Hub), the value for the environment variable must not be stored in the artifact itself (ex. inside the `Dockerfile` or one of the container's files) but rather must be passed dynamically, for example in the `docker run` call as an argument.\n\n* ### Secret management services\n\nExternal vendors offer cloud-based secret management services, that provide proper access control to each secret. The given access to each secret can be dynamically modified or even revoked. Some examples include -\n\n* [Hashicorp Vault](https://www.vaultproject.io)\n* [AWS KMS](https://aws.amazon.com/kms) (Key Management Service)\n* [Google Cloud KMS](https://cloud.google.com/security-key-management)\n\n## Least-privilege principle\n\nStoring a secret in a hardcoded manner can be made safer, by making sure the secret grants the least amount of privilege as needed by the application.\nFor example - if the application needs to read a specific table from a specific database, and the secret grants access to perform this operation **only** (meaning - no access to other tables, no write access at all) then the damage from any secret leaks is mitigated.\nThat being said, it is still not recommended to store secrets in a hardcoded manner, since this type of storage does not offer any way to revoke or moderate the usage of the secret.\n"
              },
              "properties": {
                "applicability": "applicable",
                "conclusion": "negative",
                "security-severity": "6.9"
              }
            },
            {
              "id": "REQ.SECRET.GENERIC.CODE",
              "name": "REQ.SECRET.GENERIC.CODE",
              "shortDescription": {
                "text": "Scanner for REQ.SECRET.GENERIC.CODE"
              },
              "fullDescription": {
                "text": "Storing hardcoded secrets in your source code or binary artifact could lead to several risks.\n\nIf the secret is associated with a wide scope of privileges, attackers could extract it from the source code or binary artifact and use it maliciously to attack many targets. For example, if the hardcoded password gives high-privilege access to an AWS account, the attackers may be able to query/modify company-wide sensitive data without per-user authentication.\n\n## Best practices\n\nUse safe storage when storing high-privilege secrets such as passwords and tokens, for example -\n\n* ### Environment Variables\n\nEnvironment variables are set outside of the application code, and can be dynamically passed to the application only when needed, for example -\n`SECRET_VAR=MySecret ./my_application`\nThis way, `MySecret` does not have to be hardcoded into `my_application`.\n\nNote that if your entire binary artifact is published (ex. a Docker container published to Docker Hub), the value for the environment variable must not be stored in the artifact itself (ex. inside the `Dockerfile` or one of the container's files) but rather must be passed dynamically, for example in the `docker run` call as an argument.\n\n* ### Secret management services\n\nExternal vendors offer cloud-based secret management services, that provide proper access control to each secret. The given access to each secret can be dynamically modified or even revoked. Some examples include -\n\n* [Hashicorp Vault](https://www.vaultproject.io)\n* [AWS KMS](https://aws.amazon.com/kms) (Key Management Service)\n* [Google Cloud KMS](https://cloud.google.com/security-key-management)\n\n## Least-privilege principle\n\nStoring a secret in a hardcoded manner can be made safer, by making sure the secret grants the least amount of privilege as needed by the application.\nFor example - if the application needs to read a specific table from a specific database, and the secret grants access to perform this operation **only** (meaning - no access to other tables, no write access at all) then the damage from any secret leaks is mitigated.\nThat being said, it is still not recommended to store secrets in a hardcoded manner, since this type of storage does not offer any way to revoke or moderate the usage of the secret.\n",
                "markdown": "Storing hardcoded secrets in your source code or binary artifact could lead to several risks.\n\nIf the secret is associated with a wide scope of privileges, attackers could extract it from the source code or binary artifact and use it maliciously to attack many targets. For example, if the hardcoded password gives high-privilege access to an AWS account, the attackers may be able to query/modify company-wide sensitive data without per-user authentication.\n\n## Best practices\n\nUse safe storage when storing high-privilege secrets such as passwords and tokens, for example -\n\n* ### Environment Variables\n\nEnvironment variables are set outside of the application code, and can be dynamically passed to the application only when needed, for example -\n`SECRET_VAR=MySecret ./my_application`\nThis way, `MySecret` does not have to be hardcoded into `my_application`.\n\nNote that if your entire binary artifact is published (ex. a Docker container published to Docker Hub), the value for the environment variable must not be stored in the artifact itself (ex. inside the `Dockerfile` or one of the container's files) but rather must be passed dynamically, for example in the `docker run` call as an argument.\n\n* ### Secret management services\n\nExternal vendors offer cloud-based secret management services, that provide proper access control to each secret. The given access to each secret can be dynamically modified or even revoked. Some examples include -\n\n* [Hashicorp Vault](https://www.vaultproject.io)\n* [AWS KMS](https://aws.amazon.com/kms) (Key Management Service)\n* [Google Cloud KMS](https://cloud.google.com/security-key-management)\n\n## Least-privilege principle\n\nStoring a secret in a hardcoded manner can be made safer, by making sure the secret grants the least amount of privilege as needed by the application.\nFor example - if the application needs to read a specific table from a specific database, and the secret grants access to perform this operation **only** (meaning - no access to other tables, no write access at all) then the damage from any secret leaks is mitigated.\nThat being said, it is still not recommended to store secrets in a hardcoded manner, since this type of storage does not offer any way to revoke or moderate the usage of the secret.\n"
              },
              "properties": {
                "applicability": "applicable",
                "conclusion": "negative",
                "security-severity": "6.9"
              }
            },
            {
              "id": "REQ.SECRET.GENERIC.URL",
              "name": "REQ.SECRET.GENERIC.URL",
              "shortDescription": {
                "text": "Scanner for REQ.SECRET.GENERIC.URL"
              },
              "fullDescription": {
                "text": "Storing hardcoded secrets in your source code or binary artifact could lead to several risks.\n\nIf the secret is associated with a wide scope of privileges, attackers could extract it from the source code or binary artifact and use it maliciously to attack many targets. For example, if the hardcoded password gives high-privilege access to an AWS account, the attackers may be able to query/modify company-wide sensitive data without per-user authentication.\n\n## Best practices\n\nUse safe storage when storing high-privilege secrets such as passwords and tokens, for example -\n\n* ### Environment Variables\n\nEnvironment variables are set outside of the application code, and can be dynamically passed to the application only when needed, for example -\n`SECRET_VAR=MySecret ./my_application`\nThis way, `MySecret` does not have to be hardcoded into `my_application`.\n\nNote that if your entire binary artifact is published (ex. a Docker container published to Docker Hub), the value for the environment variable must not be stored in the artifact itself (ex. inside the `Dockerfile` or one of the container's files) but rather must be passed dynamically, for example in the `docker run` call as an argument.\n\n* ### Secret management services\n\nExternal vendors offer cloud-based secret management services, that provide proper access control to each secret. The given access to each secret can be dynamically modified or even revoked. Some examples include -\n\n* [Hashicorp Vault](https://www.vaultproject.io)\n* [AWS KMS](https://aws.amazon.com/kms) (Key Management Service)\n* [Google Cloud KMS](https://cloud.google.com/security-key-management)\n\n## Least-privilege principle\n\nStoring a secret in a hardcoded manner can be made safer, by making sure the secret grants the least amount of privilege as needed by the application.\nFor example - if the application needs to read a specific table from a specific database, and the secret grants access to perform this operation **only** (meaning - no access to other tables, no write access at all) then the damage from any secret leaks is mitigated.\nThat being said, it is still not recommended to store secrets in a hardcoded manner, since this type of storage does not offer any way to revoke or moderate the usage of the secret.\n",
                "markdown": "Storing hardcoded secrets in your source code or binary artifact could lead to several risks.\n\nIf the secret is associated with a wide scope of privileges, attackers could extract it from the source code or binary artifact and use it maliciously to attack many targets. For example, if the hardcoded password gives high-privilege access to an AWS account, the attackers may be able to query/modify company-wide sensitive data without per-user authentication.\n\n## Best practices\n\nUse safe storage when storing high-privilege secrets such as passwords and tokens, for example -\n\n* ### Environment Variables\n\nEnvironment variables are set outside of the application code, and can be dynamically passed to the application only when needed, for example -\n`SECRET_VAR=MySecret ./my_application`\nThis way, `MySecret` does not have to be hardcoded into `my_application`.\n\nNote that if your entire binary artifact is published (ex. a Docker container published to Docker Hub), the value for the environment variable must not be stored in the artifact itself (ex. inside the `Dockerfile` or one of the container's files) but rather must be passed dynamically, for example in the `docker run` call as an argument.\n\n* ### Secret management services\n\nExternal vendors offer cloud-based secret management services, that provide proper access control to each secret. The given access to each secret can be dynamically modified or even revoked. Some examples include -\n\n* [Hashicorp Vault](https://www.vaultproject.io)\n* [AWS KMS](https://aws.amazon.com/kms) (Key Management Service)\n* [Google Cloud KMS](https://cloud.google.com/security-key-management)\n\n## Least-privilege principle\n\nStoring a secret in a hardcoded manner can be made safer, by making sure the secret grants the least amount of privilege as needed by the application.\nFor example - if the application needs to read a specific table from a specific database, and the secret grants access to perform this operation **only** (meaning - no access to other tables, no write access at all) then the damage from any secret leaks is mitigated.\nThat being said, it is still not recommended to store secrets in a hardcoded manner, since this type of storage does not offer any way to revoke or moderate the usage of the secret.\n"
              },
              "properties": {
                "applicability": "not_applicable",
                "conclusion": "positive"
              }
            },
            {
              "id": "REQ.SECRET.KEYS",
              "name": "REQ.SECRET.KEYS",
              "shortDescription": {
                "text": "Scanner for REQ.SECRET.KEYS"
              },
              "fullDescription": {
                "text": "\nStoring an API key in the image could lead to several risks.\n\nIf the key is associated with a wide scope of privileges, attackers could extract it from a single image or firmware and use it maliciously to attack many targets. For example, if the embedded key allows querying/modifying data for all cloud user accounts, without per-user authentication, the attackers who extract it would gain access to system-wide data.\n\nIf the cloud/SaaS provider bills by key usage - for example, every million queries cost the key's owner a fixed sum of money - attackers could use the keys for their own purposes (or just as a form of vandalism), incurring a large cost to the legitimate user or operator.\n\n## Best practices\n\nUse narrow scopes for stored API keys. As much as possible, API keys should be unique per host and require additional authentication with the user's individual credentials for any sensitive actions.\n\nAvoid placing keys whose use incurs costs directly in the image. Store the key with any software or hardware protection available on the host for key storage (such as operating system key-stores, hardware cryptographic storage mechanisms or cloud-managed secure storage services such as [AWS KMS](https://aws.amazon.com/kms/)).\n\nTokens that were detected as exposed should be revoked and replaced -\n\n* [AWS Key Revocation](https://aws.amazon.com/premiumsupport/knowledge-center/delete-access-key/#:~:text=If%20you%20see%20a%20warning,the%20confirmation%20box%2C%20choose%20Deactivate.)\n* [GCP Key Revocation](https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/CloudIAM/delete-api-keys.html)\n* [Azure Key Revocation](https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops&tabs=Windows#revoke-a-pat)\n* [GitHub Key Revocation](https://docs.github.com/en/rest/apps/oauth-applications#delete-an-app-authorization)\n",
                "markdown": "\nStoring an API key in the image could lead to several risks.\n\nIf the key is associated with a wide scope of privileges, attackers could extract it from a single image or firmware and use it maliciously to attack many targets. For example, if the embedded key allows querying/modifying data for all cloud user accounts, without per-user authentication, the attackers who extract it would gain access to system-wide data.\n\nIf the cloud/SaaS provider bills by key usage - for example, every million queries cost the key's owner a fixed sum of money - attackers could use the keys for their own purposes (or just as a form of vandalism), incurring a large cost to the legitimate user or operator.\n\n## Best practices\n\nUse narrow scopes for stored API keys. As much as possible, API keys should be unique per host and require additional authentication with the user's individual credentials for any sensitive actions.\n\nAvoid placing keys whose use incurs costs directly in the image. Store the key with any software or hardware protection available on the host for key storage (such as operating system key-stores, hardware cryptographic storage mechanisms or cloud-managed secure storage services such as [AWS KMS](https://aws.amazon.com/kms/)).\n\nTokens that were detected as exposed should be revoked and replaced -\n\n* [AWS Key Revocation](https://aws.amazon.com/premiumsupport/knowledge-center/delete-access-key/#:~:text=If%20you%20see%20a%20warning,the%20confirmation%20box%2C%20choose%20Deactivate.)\n* [GCP Key Revocation](https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/CloudIAM/delete-api-keys.html)\n* [Azure Key Revocation](https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops&tabs=Windows#revoke-a-pat)\n* [GitHub Key Revocation](https://docs.github.com/en/rest/apps/oauth-applications#delete-an-app-authorization)\n"
              },
              "properties": {
                "applicability": "applicable",
                "conclusion": "negative",
                "security-severity": "6.9"
              }
            }
          ],
          "version": "1.0"
        }
      },
      "invocations": [
        {
          "arguments": [
            "/home/runner/.jfrog/dependencies/analyzerManager/jas_scanner/jas_scanner",
            "scan",
            "/tmp/jfrog.cli.temp.-1721808366-2342009255/Secrets_1721808366/config.yaml"
          ],
          "executionSuccessful": true,
          "workingDirectory": {
            "uri": "/tmp/jfrog.cli.temp.-1721808302-2054180533/image.tar"
          }
        }
      ],
      "results": [
        {
          "ruleId": "REQ.SECRET.GENERIC.TEXT",
          "message": {
            "text": "Hardcoded secrets were found"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "file:///tmp/tmpsgcanxxs/unpacked/filesystem/blobs/sha256/bde451613ef3570e3b66c8cdbe1f880706134d7e02d8b528be5b9957466cc318/home/webgoat/webgoat.jar/BOOT-INF/classes/lessons/jwt/documentation/JWT_libraries.adoc"
                },
                "region": {
                  "startLine": 28,
                  "startColumn": 4,
                  "endLine": 28,
                  "endColumn": 4,
                  "snippet": {
                    "text": "tok************"
                  }
                }
              }
            }
          ]
        },
        {
          "ruleId": "REQ.SECRET.GENERIC.TEXT",
          "message": {
            "text": "Hardcoded secrets were found"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "file:///tmp/tmpsgcanxxs/unpacked/filesystem/blobs/sha256/bde451613ef3570e3b66c8cdbe1f880706134d7e02d8b528be5b9957466cc318/home/webgoat/webgoat.jar/BOOT-INF/classes/lessons/jwt/documentation/JWT_libraries.adoc"
                },
                "region": {
                  "startLine": 40,
                  "startColumn": 4,
                  "endLine": 40,
                  "endColumn": 4,
                  "snippet": {
                    "text": "tok************"
                  }
                }
              }
            }
          ]
        },
        {
          "ruleId": "REQ.SECRET.GENERIC.TEXT",
          "message": {
            "text": "Hardcoded secrets were found"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "file:///tmp/tmpsgcanxxs/unpacked/filesystem/blobs/sha256/bde451613ef3570e3b66c8cdbe1f880706134d7e02d8b528be5b9957466cc318/home/webgoat/webgoat.jar/BOOT-INF/classes/lessons/jwt/documentation/JWT_libraries.adoc"
                },
                "region": {
                  "startLine": 56,
                  "startColumn": 4,
                  "endLine": 56,
                  "endColumn": 4,
                  "snippet": {
                    "text": "tok************"
                  }
                }
              }
            }
          ]
        },
        {
          "ruleId": "REQ.SECRET.GENERIC.TEXT",
          "message": {
            "text": "Hardcoded secrets were found"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "file:///tmp/tmpsgcanxxs/unpacked/filesystem/blobs/sha256/bde451613ef3570e3b66c8cdbe1f880706134d7e02d8b528be5b9957466cc318/home/webgoat/webgoat.jar/BOOT-INF/classes/lessons/jwt/documentation/JWT_refresh.adoc"
                },
                "region": {
                  "startLine": 32,
                  "startColumn": 5,
                  "endLine": 32,
                  "endColumn": 5,
                  "snippet": {
                    "text": "ref************"
                  }
                }
              }
            }
          ]
        },
        {
          "ruleId": "REQ.SECRET.GENERIC.TEXT",
          "message": {
            "text": "Hardcoded secrets were found"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "file:///tmp/tmpsgcanxxs/unpacked/filesystem/blobs/sha256/bde451613ef3570e3b66c8cdbe1f880706134d7e02d8b528be5b9957466cc318/home/webgoat/webgoat.jar/BOOT-INF/classes/lessons/jwt/documentation/JWT_signing_solution.adoc"
                },
                "region": {
                  "startLine": 35,
                  "startColumn": 1,
                  "endLine": 35,
                  "endColumn": 1,
                  "snippet": {
                    "text": "acc************"
                  }
                }
              }
            }
          ]
        },
        {
          "ruleId": "REQ.SECRET.GENERIC.TEXT",
          "message": {
            "text": "Hardcoded secrets were found"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "file:///tmp/tmpsgcanxxs/unpacked/filesystem/blobs/sha256/bde451613ef3570e3b66c8cdbe1f880706134d7e02d8b528be5b9957466cc318/home/webgoat/webgoat.jar/BOOT-INF/classes/lessons/lessontemplate/documentation/lesson-template-attack.adoc"
                },
                "region": {
                  "startLine": 12,
                  "startColumn": 25,
                  "endLine": 12,
                  "endColumn": 25,
                  "snippet": {
                    "text": "sec************"
                  }
                }
              }
            }
          ]
        },
        {
          "ruleId": "REQ.SECRET.GENERIC.TEXT",
          "message": {
            "text": "Hardcoded secrets were found"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "file:///tmp/tmpsgcanxxs/unpacked/filesystem/blobs/sha256/bde451613ef3570e3b66c8cdbe1f880706134d7e02d8b528be5b9957466cc318/opt/java/openjdk/conf/management/jmxremote.password.template"
                },
                "region": {
                  "startLine": 44,
                  "startColumn": 2,
                  "endLine": 44,
                  "endColumn": 2,
                  "snippet": {
                    "text": "has************"
                  }
                }
              }
            }
          ]
        },
        {
          "ruleId": "REQ.SECRET.GENERIC.CODE",
          "message": {
            "text": "Hardcoded secrets were found"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "file:///tmp/tmpsgcanxxs/unpacked/filesystem/blobs/sha256/bde451613ef3570e3b66c8cdbe1f880706134d7e02d8b528be5b9957466cc318/home/webgoat/webgoat.jar/BOOT-INF/classes/lessons/jwt/js/jwt-refresh.js"
                },
                "region": {
                  "startLine": 10,
                  "startColumn": 42,
                  "endLine": 10,
                  "endColumn": 42,
                  "snippet": {
                    "text": "pas************"
                  }
                }
              }
            }
          ]
        },
        {
          "ruleId": "REQ.SECRET.GENERIC.CODE",
          "message": {
            "text": "Hardcoded secrets were found"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "file:///tmp/tmpsgcanxxs/unpacked/filesystem/blobs/sha256/bde451613ef3570e3b66c8cdbe1f880706134d7e02d8b528be5b9957466cc318/home/webgoat/webgoat.jar/BOOT-INF/lib/jruby-stdlib-9.4.3.0.jar/META-INF/jruby.home/lib/ruby/stdlib/bundler/vendor/uri/lib/uri/generic.rb"
                },
                "region": {
                  "startLine": 495,
                  "startColumn": 12,
                  "endLine": 495,
                  "endColumn": 12,
                  "snippet": {
                    "text": "pas************"
                  }
                }
              }
            }
          ]
        },
        {
          "ruleId": "REQ.SECRET.GENERIC.CODE",
          "message": {
            "text": "Hardcoded secrets were found"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "file:///tmp/tmpsgcanxxs/unpacked/filesystem/blobs/sha256/bde451613ef3570e3b66c8cdbe1f880706134d7e02d8b528be5b9957466cc318/home/webgoat/webgoat.jar/BOOT-INF/lib/jruby-stdlib-9.4.3.0.jar/META-INF/jruby.home/lib/ruby/stdlib/uri/generic.rb"
                },
                "region": {
                  "startLine": 495,
                  "startColumn": 12,
                  "endLine": 495,
                  "endColumn": 12,
                  "snippet": {
                    "text": "pas************"
                  }
                }
              }
            }
          ]
        },
        {
          "ruleId": "REQ.SECRET.KEYS",
          "message": {
            "text": "Secret keys were found"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "file:///tmp/tmpsgcanxxs/unpacked/filesystem/blobs/sha256/bde451613ef3570e3b66c8cdbe1f880706134d7e02d8b528be5b9957466cc318/home/webgoat/webgoat.jar/BOOT-INF/classes/lessons/jwt/documentation/JWT_libraries.adoc"
                },
                "region": {
                  "startLine": 28,
                  "startColumn": 13,
                  "endLine": 28,
                  "endColumn": 13,
                  "snippet": {
                    "text": "eyJ************"
                  }
                }
              }
            }
          ]
        },
        {
          "ruleId": "REQ.SECRET.KEYS",
          "message": {
            "text": "Secret keys were found"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "file:///tmp/tmpsgcanxxs/unpacked/filesystem/blobs/sha256/bde451613ef3570e3b66c8cdbe1f880706134d7e02d8b528be5b9957466cc318/home/webgoat/webgoat.jar/BOOT-INF/classes/lessons/jwt/documentation/JWT_libraries.adoc"
                },
                "region": {
                  "startLine": 40,
                  "startColumn": 14,
                  "endLine": 40,
                  "endColumn": 14,
                  "snippet": {
                    "text": "eyJ************"
                  }
                }
              }
            }
          ]
        },
        {
          "ruleId": "REQ.SECRET.KEYS",
          "message": {
            "text": "Secret keys were found"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "file:///tmp/tmpsgcanxxs/unpacked/filesystem/blobs/sha256/bde451613ef3570e3b66c8cdbe1f880706134d7e02d8b528be5b9957466cc318/home/webgoat/webgoat.jar/BOOT-INF/classes/lessons/jwt/documentation/JWT_libraries.adoc"
                },
                "region": {
                  "startLine": 56,
                  "startColumn": 15,
                  "endLine": 56,
                  "endColumn": 15,
                  "snippet": {
                    "text": "Jhb************"
                  }
                }
              }
            }
          ]
        },
        {
          "ruleId": "REQ.SECRET.KEYS",
          "message": {
            "text": "Secret keys were found"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "file:///tmp/tmpsgcanxxs/unpacked/filesystem/blobs/sha256/bde451613ef3570e3b66c8cdbe1f880706134d7e02d8b528be5b9957466cc318/home/webgoat/webgoat.jar/BOOT-INF/classes/lessons/jwt/documentation/JWT_libraries.adoc"
                },
                "region": {
                  "startLine": 56,
                  "startColumn": 32,
                  "endLine": 56,
                  "endColumn": 32,
                  "snippet": {
                    "text": "idH************"
                  }
                }
              }
            }
          ]
        }
      ]
    }
  ]
}