{"id":15166063,"url":"https://github.com/jenkinsci/secone-security-plugin","last_synced_at":"2026-02-09T18:31:23.564Z","repository":{"id":218937560,"uuid":"747731487","full_name":"jenkinsci/secone-security-plugin","owner":"jenkinsci","description":"Scan your projects for vulnerabilities with Jenkins. This plugin is officially maintained by Sec1.","archived":false,"fork":false,"pushed_at":"2025-01-01T17:10:48.000Z","size":299,"stargazers_count":0,"open_issues_count":3,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-01-30T04:24:55.535Z","etag":null,"topics":["devsecops","security"],"latest_commit_sha":null,"homepage":"https://sec1.io","language":"Java","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jenkinsci.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-01-24T14:31:09.000Z","updated_at":"2024-10-17T03:08:03.000Z","dependencies_parsed_at":"2024-01-24T16:28:53.957Z","dependency_job_id":"858bb03c-ad08-48c2-8edb-be3215cd87b3","html_url":"https://github.com/jenkinsci/secone-security-plugin","commit_stats":{"total_commits":56,"total_committers":5,"mean_commits":11.2,"dds":0.2678571428571429,"last_synced_commit":"3a32e8abdac3598720ffa6777f1f9d88ed176a2d"},"previous_names":["jenkinsci/secone-security-plugin"],"tags_count":3,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jenkinsci%2Fsecone-security-plugin","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jenkinsci%2Fsecone-security-plugin/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jenkinsci%2Fsecone-security-plugin/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jenkinsci%2Fsecone-security-plugin/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jenkinsci","download_url":"https://codeload.github.com/jenkinsci/secone-security-plugin/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":237215757,"owners_count":19273551,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["devsecops","security"],"created_at":"2024-09-27T04:40:20.312Z","updated_at":"2025-10-19T21:30:59.461Z","avatar_url":"https://github.com/jenkinsci.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Sec1 Security\n\n[![Sec1](https://digitalassets.sec1.io/sec1-logo.svg)](https://sec1.io)\n\n## Introduction\n\nSec1 Security plugin help developers/teams to scan their SCM for open source vulnerabilities against Sec1 Security DB\n\n## Usage\nTo use the plugin up you will need to take the following steps in order:\n\n1. [Install the Sec1 Security Plugin](#1-install-the-sec1-security-plugin)\n2. [Configure a Sec1 API Token Credential](#2-configure-a-sec1-api-token-credential)\n3. [Add Sec1 Security to your Project](#3-add-sec1-security-to-your-project)\n\n## 1. Install the SEC1 Security Plugin\n\n- Go to \"Manage Jenkins\" \u003e \"System Configuration\" \u003e \"Plugins\".\n- Search for \"Sec1 Security\" under \"Available plugins\".\n- Install the plugin.\n\n### Custom API Endpoints\n\nBy default, Sec1 uses the https://api.sec1.io endpoint. \nIt is possible to configure Sec1 to use a different endpoint by changing the `SEC1_INSTANCE_URL` environment variable:\n\n- Go to \"Manage Jenkins\" \u003e \"System Configuration\" -\u003e \"System\"\n- Under \"Global properties\" check the \"Environment variables\" option\n- Click \"Add\"\n- Set the name to `SEC1_INSTANCE_URL` and the value to the custom endpoint\n\n\n## 2. Configure a Sec1 API Token Credential\n\n- Go to \"Manage Jenkins\" \u003e \"Security\" \u003e \"Credentials\"\n- Choose a Store\n- Choose a Domain\n- Go to \"Add Credentials\"\n- Select \"Secret text\"\n- Add `\u003cYOUR_SEC1_API_KEY_ID\u003e` as ID and Configure the Credentials.\n- Remember the \"ID\" as you'll need it when configuring the build step.\n\nTo get `Sec1 Api Key` navigate to [Scopy](https://scopy.sec1.io/) \u003e \"Login with GitHub\" \u003e \"Settings\" \n- In \"API key\" section, click on \"Generate API key\"\n- Copy key for use.\n\n\u003cblockquote\u003e\n\u003cdetails\u003e\n\u003csummary\u003e📷 Show Preview\u003c/summary\u003e\n\n![Sec1 API Token](docs/sec1-configuration-api-key.png)\n\n\u003c/details\u003e\n\u003c/blockquote\u003e\n\n## 3. Add Sec1 Security to your Project\n\nThis step will depend on if you're using Freestyle Projects or Pipeline Projects.\n\n### Freestyle Projects\n\n- Select a project\n- Go to \"Configure\"\n- Under \"Build\", select \"Add build step\" select \"Execute Sec1 Security Scanner\"\n- Configure as needed. Click the \"?\" icons for more information about each option.\n\n\u003cblockquote\u003e\n\u003cdetails\u003e\n\u003csummary\u003e📷 Show Preview\u003c/summary\u003e\n\n![Basic configuration](docs/sec1-buildstep.png)\n\n\u003c/details\u003e\n\u003c/blockquote\u003e\n\n### Pipeline Projects\n\nUse the `sec1Security` step as part of your pipeline script. You can use the \"Snippet Generator\" to generate the code\nfrom a web form and copy it into your pipeline.\n\n\u003cblockquote\u003e\n\u003cdetails\u003e\n\u003csummary\u003e📷 Show Example\u003c/summary\u003e\n\n```groovy\npipeline {\n  agent any\n\n  stages {\n    stage('Build') {\n      steps {\n        echo 'Building...'\n      }\n    }\n    stage('Sec1 Security') {\n            steps {\n                script {\n                    sec1Security (\n                        scanFileLocation: \"${WORKSPACE}\", // this is the location of you scm checkout directory. if not configured don't change it.\n                        apiCredentialsId: \"\u003cYour Sec1 Api Key ID\u003e\", \n                        //optional\n                        applyThreshold: true,\n                        actionOnThresholdBreached: \"unstable\",\n                        threshold: [criticalThreshold: '0', highThreshold: '0']\n                    )\n                }\n            }\n        }\n    stage('Deploy') {\n      steps {\n        echo 'Deploying...'\n      }\n    }\n  }\n}\n```\n\n\u003c/details\u003e\n\u003c/blockquote\u003e\nWhether the step should fail if issues and vulnerabilities are found.\nYou can pass the following parameters to your `sec1Security` step.\n\n#### `scanFileLocation` (required, default: `${WORKSPACE}`)\n\nLocation where scm checkout is done. Default is `${WORKSPACE}` of build job.\n\nScan will fill if you dont provide this value.\n\n#### `apiCredentialsId` (optional, default: *none*)\n\nSec1 Api Key Credential ID. As configured in \"[2. Configure a Sec1 API Token Credential](#2-configure-a-sec1-api-token-credential)\".\n\n#### `applyThreshold` (optional, default: `false`)\n\nWhether vulnerability threshold needs to be applied on the build.\n\n#### `threshold` (optional, default: `false`)\n\nThreshold values for each type of vulerability. e.g. configuration:\n[criticalThreshold: '0', highThreshold: '10', mediumThreshold: '0', lowThreshold: '0']\n\nIf scan reports gives more vulnerabilities than configured threshold for the respective type of vulnerability then error will be shown in console and build status will be modified based on actionOnThresholdBreached value.\n\n#### `actionOnThresholdBreached` (optional, default: `fail`)\n\nThe action which needs to be taken on build if vulnerability threshold is breached. Possible values: `fail`, `unstable`, `continue`\n\n## Troubleshooting\n\nTo see more information on your steps:\n\n- View the \"Console Output\" for a specific build.\n\n---\n\n-- Sec1 team","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjenkinsci%2Fsecone-security-plugin","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjenkinsci%2Fsecone-security-plugin","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjenkinsci%2Fsecone-security-plugin/lists"}