wrong line numbers for secrets detected after private key secret

[k11h-de]

Description

When running secret scan (tested with git repo and filesystem) on a file that contains a Asymmetric Private Key the line numbers for the findings after that are messed up. This happens for built-in and also custom secret detection rules.

May be related to #8395

Desired Behavior

line numbers are correctly printed

Actual Behavior

Wrong line numbers are printed.

Reproduction Steps

1. Create a sample file like:


AWS_ACCESS_KEY_ID_LINE1=AKIA0123456789ABCDEF
# 2
my_key_private: |
  -----BEGIN RSA PRIVATE KEY-----
  MIIEogIBAAKCAQEAoLVDC0vA+b6JV1JXOy3ir10mECNmsfQDArXxpe5K1tUu9dPy
  3U4hKVuGNCac7lGOgdN89UQh8ddwlsC2uBaE5KjV4CFOYR9MDrE=
  -----END RSA PRIVATE KEY-----
# 8
# 9
AWS_ACCESS_KEY_ID_LINE10=AKIA0123456789ABCDEF
# 11


2. run command `trivy fs secrets.yaml --scanners secret --table-mode detailed`
3. check the line number for AWS_ACCESS_KEY_ID_LINE10

Target

Filesystem

Scanner

Secret

Output Format

Table

Mode

Standalone

Debug Output

$ trivy fs secrets.yaml --scanners secret --debug --trace --table-mode detailed

2025-06-27T08:14:53+02:00	DEBUG	Default config file "file_path=trivy.yaml" not found, using built in values
2025-06-27T08:14:53+02:00	DEBUG	Cache dir	dir="/Users/xxx/Library/Caches/trivy"
2025-06-27T08:14:53+02:00	DEBUG	Cache dir	dir="/Users/xxx/Library/Caches/trivy"
2025-06-27T08:14:53+02:00	DEBUG	Parsed severities	severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2025-06-27T08:14:53+02:00	DEBUG	Ignore statuses	statuses=[]
2025-06-27T08:14:53+02:00	INFO	[secret] Secret scanning is enabled
2025-06-27T08:14:53+02:00	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-06-27T08:14:53+02:00	INFO	[secret] Please see also https://trivy.dev/v0.63/docs/scanner/secret#recommendation for faster secret detection
2025-06-27T08:14:53+02:00	DEBUG	Initializing scan cache...	type="memory"
2025-06-27T08:14:53+02:00	DEBUG	[notification] Running version check
2025-06-27T08:14:53+02:00	DEBUG	[secret] No secret config detected	config_path="trivy-secret.yaml"
2025-06-27T08:14:53+02:00	DEBUG	[fs] Analyzing...	root="secrets.yaml"
2025-06-27T08:14:53+02:00	DEBUG	[fs] Random cache key will be used	err="failed to open git repository: stat /Users/xxx/code/sec-ops/trivy/regex-data-verify/secrets.yaml/.git: not a directory"
2025-06-27T08:14:53+02:00	DEBUG	OS is not detected.
2025-06-27T08:14:53+02:00	DEBUG	Secret file	file_path="/secrets.yaml"
2025-06-27T08:14:53+02:00	DEBUG	Specified ignore file does not exist	file=".trivyignore"
2025-06-27T08:14:53+02:00	DEBUG	[vex] VEX filtering is disabled

/secrets.yaml (secrets)

Total: 3 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 2)

CRITICAL: AWS (aws-access-key-id)
══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
AWS Access Key ID
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 /secrets.yaml:1
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   1 [ AWS_ACCESS_KEY_ID_LINE1=********************
   2   # 2
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────


CRITICAL: AWS (aws-access-key-id)
══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
AWS Access Key ID
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 /secrets.yaml:7
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   5   # 8
   6   # 9
   7 [ AWS_ACCESS_KEY_ID_LINE10=********************
   8   # 11
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────


HIGH: AsymmetricPrivateKey (private-key)
══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Asymmetric Private Key
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 /secrets.yaml:4
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   2   # 2
   3   my_key_private: |
   4 [ ----BEGIN RSA PRIVATE KEY-----*****************************************************************************************************************************-----END RSA PRIVATE
   5   # 8
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Operating System

MacOS 15.5 (24F74)

Version

Version: 0.63.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2025-06-26 06:25:01.339440278 +0000 UTC
  NextUpdate: 2025-06-27 06:25:01.339440068 +0000 UTC
  DownloadedAt: 2025-06-26 08:11:39.363887 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2025-06-13 02:47:11.38912513 +0000 UTC
  NextUpdate: 2025-06-16 02:47:11.38912496 +0000 UTC
  DownloadedAt: 2025-06-13 08:30:32.813628 +0000 UTC
Check Bundle:
  Digest: sha256:a471e90b7c7335e914ec9075b74cf8f65e4c91e6cecfa7e39c587382808d2684
  DownloadedAt: 2025-06-26 08:11:40.105287 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[DmitriyLewen]

Hello @k11h-de
Thanks for your report!

Created #9086

Regards, Dmitiry