Azure Repos (cloud)

azure repos (cloud) edition enterprise only the azure repos integration scans repositories in azure devops for credentials and other sensitive data configuration the azure repos integration can be configured in trufflehog under integrations , or via a local configuration file (below) web configuration configure this integration from the integrations page in trufflehog you'll need a personal access token (pat) from azure devops with the code (read) scope local configuration create a personal access token in azure devops, click the user settings icon in the top right next to your profile picture click personal access tokens click new token name the token, select an organization, and choose custom defined then select the code (read) scope click create configure scope when specifying organizations, projects, and repositories, keep in mind at least one organization is required the hierarchy is organizations > projects > repositories projects must belong to specified organizations, and repositories must belong to specified projects specifying only organizations scans all their projects specifying only projects scans all their repositories ignore filters always override include filters, for both projects and repositories access token sources \ connection "@type" type googleapis com/sources azurerepos organizations \ trufflesecurity ignoreprojects \ project2 ignorerepos \ https //dev azure com/trufflesecurity/ignorerepo includeforks false skipbinaries true token xxxxxxxxxxxxxxxxxxxxxxxxxx name azure repos scanperiod 12h type source type azure repos verify true configuration options field type required description organizations list yes list of organizations to scan at least one is required endpoint string no endpoint url for azure repos projects list no list of projects to scan includeprojects list no projects to include in scanning ignoreprojects list no projects to skip during scanning repositories list no explicit list of repositories to scan omit to enumerate instead includerepos list no repositories to include in scanning ignorerepos list no repositories to skip during scanning includeforks boolean no include forked repositories skipbinaries boolean no skip binary files skiparchives boolean no skip archive files capabilities feature supported scan archive files ✅ scan archived repositories ✅ scan base64 encoded data ✅ scan binaries ✅ history ✅ include / exclude filters ✅ pre commit ✅ auto resume ✅ notes trufflehog does not scan diffs larger than 1 gb only cloud hosted azure repos are supported self hosted azure devops server is not scannable