Since 2009
Secret & Personal Data Scanner for ConfluenceConfluence Cloud · Atlassian ForgeFind the passwords, keys and personal data in your Confluence pages
People paste passwords, API keys and customer details into Confluence to get a job done, and then forget them. Anyone who can read the page can read them. Secret & Personal Data Scanner checks every page and blog post, so you can ask the owner to remove what it finds, or remove it and rotate the key. It never changes a page and never stores a full value.
What it does
Finds what should not be on a page, and keeps it masked
Secrets
Private keys, AWS access keys, GitHub, GitLab and Slack tokens, Slack webhook URLs, Atlassian API tokens, Stripe and Google API keys, and long random-looking strings. Passwords too: after a word like password:, under a Password column in a table, or inside a connection string.
Personal data
Email addresses, phone numbers, payment card numbers, IBANs, US Social Security numbers, UK National Insurance numbers, and Indian PAN and Aadhaar numbers. Card numbers, IBANs and Aadhaar numbers must pass their check digit, which keeps false positives down.
Checked again on every edit
Scan every page and blog post from the admin page. A full scan also runs every week, and a page is scanned again when someone creates, edits, restores or moves it.
Work through the list
Each finding by space and page, with its type, a masked value, the line it is on and who last edited the page. Filter by space, type and status. Mark a finding Resolved or False positive, and the mark stays after the next scan. Export to Excel or CSV.
Built to be safe
What it will never do
The app has no write permission at all, so Atlassian's platform itself prevents it from changing a page. Removing a value is still your call, in Confluence.
It stores a masked value (the first and last 2 characters, or nothing at all for short values), the line around it with every match masked, and a keyed hash that cannot be turned back into the value.
Only Confluence administrators can open the app, and this is checked on every request. On a page an admin can't open in Confluence, they see only the type of finding, the space and the dates.
No servers of our own and no API key. Findings are stored in Atlassian's storage for your site and never leave it. Exports are built in your browser.
Getting started
Install, scan, work through the findings
Install
In Confluence, go to Settings → Find new apps and search for Secret & Personal Data Scanner. Start the free trial.
Scan
Open Confluence administration → Secret & Personal Data Scanner and click Scan all pages. It runs in the background, and you can leave the page.
Work through the findings
Filter by space, type and status, mark each finding Resolved or False positive, and download the Excel or CSV file when you need it.
Paid through the Atlassian Marketplace, per user, billed on your Atlassian invoice, with a free trial. The listing is not public yet. Request access or ask a question.