checkmarx/2ms repository overview

⁠2ms (Too Many Secrets)

2ms is an open-source CLI from Checkmarx that helps teams surface credentials, API keys, tokens, and other sensitive data before it leaks. It builds on the gitleaks detection engine, adds Checkmarx expertise, CVSS-based scoring, and optional secret validation so you can triage the riskiest findings first.

⁠Table of Contents

• Quick Start⁠
• Highlights⁠
• Installation⁠
  • Homebrew (macOS/Linux)⁠
  • Prebuilt Binaries⁠
  • Build from Source⁠
  • Docker⁠
• Scan Targets⁠
  • Local File System⁠
  • Git Repositories⁠
  • Confluence Cloud⁠
  • Slack⁠
  • Discord⁠
  • Paligo⁠
• Configuration & Tuning⁠
  • Global Flags⁠
  • Configuration Files & Environment Variables⁠
  • Rules, Validation, and Custom Detection⁠
• Reports & Outputs⁠
• CI/CD & Automation⁠
• Contributing⁠
• Community⁠

⁠Quick Start

Install, scan your local workspace, and review the findings in seconds:

brew install 2ms
2ms filesystem --path .

Scan recent Git history instead:

2ms git . --depth 50

2ms prints a YAML summary by default and returns a non-zero exit code when secrets are detected.

⁠Highlights

• Unified scanning for local directories, Git history, Slack, Discord, Confluence Cloud, and Paligo — each exposed as a dedicated subcommand.
• Hundreds of tuned detection rules curated by Checkmarx on top of gitleaks, enriched with CVSS-based scoring in every finding.
• Optional live secret validation (--validate) to confirm whether discovered credentials are still active.
• Flexible filtering and noise reduction: --rule, --ignore-rule, --add-special-rule, --ignore-result, --regex, --allowed-values, and --max-target-megabytes.
• Rich reporting for developers and pipelines with JSON, YAML, and SARIF outputs, multiple --report-path destinations, and CI-aware exit handling via --ignore-on-exit.
• Automation ready: configuration files, 2MS_* environment variables, Docker images, and GitHub Actions templates.
• Extensible plugin architecture — contributions for new data sources are welcome.

⁠Installation

⁠Homebrew (macOS/Linux)

brew install 2ms

Upgrade with brew upgrade 2ms. Confirm the install:

2ms --version

⁠Prebuilt Binaries

Download the latest release for your platform from the releases page⁠:

• Windows (amd64)⁠
• macOS (amd64)⁠
• Linux (amd64)⁠

Unzip the archive and place the 2ms binary somewhere on your PATH (for example /usr/local/bin/2ms).

⁠Build from Source

git clone https://github.com/checkmarx/2ms.git
cd 2ms
go build -o dist/2ms ./...
./dist/2ms --version

Refer to go.mod for the minimum Go toolchain version.

⁠Docker

Run 2ms from the published container image:

docker run --rm checkmarx/2ms

Mount a workspace to scan it:

docker run --rm -v "$(pwd)":/repo checkmarx/2ms git /repo --stdout-format json

Provide tokens and other secrets through environment variables (-e SLACK_TOKEN=...) or mounted config files.

⁠Scan Targets

⁠Local File System

2ms filesystem --path . --ignore-pattern "*.log"

⁠Git Repositories

2ms git /path/to/repo --depth 200 --project-name api-service

⁠Confluence Cloud

2ms confluence https://<org>.atlassian.net/wiki --space-keys ENG,SEC --history \
  --username [email protected] --token "$ATLASSIAN_TOKEN"

URLs must be HTTPS. Without credentials 2ms scans only public content.

⁠Authentication

• To scan private spaces, provide --username and --token (API token).
• How to create a Confluence API token: https://support.atlassian.com/atlassian-account/docs/manage-api-tokens-for-your-atlassian-account/⁠

⁠Examples

• Scan all public pages (no auth):

  2ms confluence https://<org>.atlassian.net/wiki
  

  Copy

• Scan private pages with an api token or a scoped api token (requires auth):

  2ms confluence https://<org>.atlassian.net/wiki --username <USERNAME> --token <API_TOKEN>
  

  Copy

• Scan specific spaces by ID:

  2ms confluence https://<org>.atlassian.net/wiki --space-ids 1234567890,9876543210
  

  Copy

• Scan specific pages by ID:

  2ms confluence https://<org>.atlassian.net/wiki --page-ids 11223344556,99887766554
  

  Copy

⁠Slack

2ms slack --token "$SLACK_TOKEN" --team my-workspace --duration 30d --channel secure-chat

⁠Discord

2ms discord --token "$DISCORD_TOKEN" --server 1097814317077897307 --duration 9999h

⁠Paligo

2ms paligo --instance your-instance --username alice --token "$PALIGO_TOKEN"

⁠Configuration & Tuning

Global flags work with every subcommand. Combine them with configuration files and environment variables to automate 2ms in large environments.

⁠Global Flags

⁠Configuration Files & Environment Variables

Pass --config to load shared defaults:

# .2ms.yaml
log-level: debug
stdout-format: json
report-path:
  - reports/2ms.json

filesystem:
  path: .
  ignore-pattern:
    - "*.log"

You can still override values via CLI flags; the CLI always wins over config values.

⁠Rules, Validation, and Custom Detection

• List the available detection rules (and whether they support validation) with 2ms rules.
• The full rule catalog lives in docs/list-of-rules.md⁠.
• Focus on specific checks with --rule <rule-id> or exclude noisy ones with --ignore-rule.
• Enable opt-in detections via --add-special-rule <rule-id> and tailor searches using custom --regex patterns.
• Suppress individual findings with --ignore-result <secret-id> or whitelist known safe secrets using --allowed-values.
• --validate asks 2ms to contact the upstream service (when available) to confirm a secret is still active. Validation outcomes feed into the CVSS-derived score in each result.

⁠Reports & Outputs

2ms prints YAML summaries by default. Switch formats or emit multiple artifacts:

2ms git . \
  --stdout-format json \
  --report-path build/2ms.sarif \
  --report-path build/2ms.yaml

SARIF reports plug directly into GitHub Advanced Security or other code-scanning dashboards. All outputs include rule metadata, severity scores, file locations, and (when enabled) validation status.

⁠CI/CD & Automation

Run 2ms in pipelines, scheduled jobs, or security gates:

name: secret-scan
on:
  pull_request:
  push:
    branches: [main]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
        with:
          fetch-depth: 0
      - name: Run 2ms
        run: |
          docker run --rm -v "$PWD":/repo checkmarx/2ms \
            git /repo --stdout-format sarif \
            --report-path /repo/artifacts/2ms.sarif \
            --ignore-on-exit results
      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: artifacts/2ms.sarif

Use --ignore-on-exit results to keep pipelines green when only findings (not errors) are present, or leave it at the default none to fail on detected secrets.

⁠Contributing

2ms is built around a plugin system so new targets and enhancements are easy to add. Check out CONTRIBUTING.md⁠ for development setup, coding guidelines, and how to propose new rules or plugins.

⁠Community

• Report issues or feature requests⁠

2ms is maintained by Checkmarx and released under the Apache 2.0 License⁠ — contributions and feedback are always welcome.