Plane Argus: native sensitive data scanning for work items and comments

Find card numbers, government IDs, and credentials in your work items, pages, and comments, without Plane storing the values it finds.

Copy as markdown

Share

Start a free trial

Share

Start a free trial

Argus is Plane's new sensitive data scanner. Workspace admins start a scan and see exactly where each match sits, down to the field. Only the location is recorded, never the value itself.

A scan of all projects, from Run scan to its result. It reports 16 findings for the first time, and no row shows a matched value.

In workspace settings, open Sensitive data scanning under Administration and select Run scan. Pick the projects, the content types, and how recently the content was updated, so a follow-up scan can cover one project's last 30 days. Argus runs the scan in the background and shows the number of findings when it's done.

Configure scan in Plane, with one project and Last 30 days selected.

Each finding names what was found, like an AWS access key ID or a payment card number, along with the content type, field, severity, confidence, and status. The matched value isn't shown, and findings on work items and project pages link to the source.

A Scan result page in Plane with the scan's scope, a count per severity and the findings table.

Built-in detectors cover financial data, contact and network details, credentials and secrets, and identifiers for the US, the UK and EU, and India. Payment card and IBAN detectors check a number's checksum before reporting it. Each detector has an on/off switch, a minimum confidence, and a severity override, and you can add custom patterns for identifiers only your company uses.

The Detectors tab of sensitive data scanning in Plane, with the Credentials and secrets group open

Keys and connection strings end up in incident notes and comments when people are moving fast. Argus shows each secret once, with a count of every place it appears, so a key copied into four work items is one thing to rotate, not four findings to chase. Mark it In review while you do.

Group by secret showing an AWS access key ID found in four places as one row. With grouping off, one finding is marked as in review

QA work items are full of synthetic card numbers that look real to a scanner. Add one to the allow list and its other open findings clear, and later scans skip it, so the next review shows only what's real.

A test card's finding is marked as non-sensitive, with the card number added to the allow list as a literal value

Security and compliance reviewers often aren't workspace admins. Export the findings as a CSV, with one row per finding and no matched values, so you can share the list without sharing the secrets. The download link works once and then expires.

Export CSV from a scan result. The button reads Preparing…, then Download ready, and the file is saved

Page comments, attachments, images, and the descriptions of cycles, modules, initiatives, teamspaces, and customers aren't scanned.

A list of findings is a map of where your secrets are, so Argus doesn't keep the values. Each finding stores the location (the content, the field, and the position of the match) and an HMAC-SHA256 fingerprint of the matched text, keyed to your workspace. Payment card findings also keep a masked preview of the last four digits. The fingerprint lets a re-scan recognize a value it already reported, and it's what Group by secret groups on.

A test in CI seeds known values, runs a scan, and fails if any of them shows up in Argus's tables, API responses, exports, metrics, or logs.

Argus is in Beta and available on the Enterprise Grid plan, from v3.2.0. See the setup guide, the sensitive data scanning docs, and the v3.2.0 release notes.