# Scan hosted repositories for sensitive information?
**URL:** https://community.sonatype.com/t/scan-hosted-repositories-for-sensitive-information/14174
**Category:** Sonatype Nexus Repository
**Created:** [January 16, 2025, 12:29am UTC](https://community.sonatype.com/t/scan-hosted-repositories-for-sensitive-information/14174 "2025-01-16T00:29:21Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@gaudette](https://community.sonatype.com/u/gaudette)
#### Post date: [January 16, 2025, 12:29am UTC](https://community.sonatype.com/t/scan-hosted-repositories-for-sensitive-information/14174/1 "2025-01-16T00:29:21Z")
We would like to scan artifacts in our Sonatype Nexus Repository (OSS 3.70.1-02, not PRO) for sensitive content to find things that our on-prem developers might have left in source code inadvertently - for example, any credentials like client IDs, client secrets, passwords, or private keys.
Does anyone have a recommendation for a strategy that might support this effort? At present the best solution I have is to individually submit JARs, WARs ZIPs etc to an external service for which we’re licensed – manually. Given the number of releases we have, that’s very impractical.
Thanks for your time.
---
### Author:  [@jboss-04](https://community.sonatype.com/u/jboss-04)
#### Post date: [January 16, 2025, 8:18am UTC](https://community.sonatype.com/t/scan-hosted-repositories-for-sensitive-information/14174/2 "2025-01-16T08:18:11Z")
Hello George, I am doing something very similar in my project. I am implementing a plugin, that pushes the content from NXRM3 to Maven Central and prior the push it scans the artifacts for rules mandatory for Maven Central artifacts.
While you need to have different set of tests, you may get the inspiration how I crawl the content. I originally supported both Postgres and OrientDB configurations (thus the split to multiple jars).
Have a look here: [GitHub - jbossorg/nx3-maven-central-deploy: Plugin for deployment of artifacts from Sonatype Nexus 3 repositories to Maven Central.](https://github.com/jbossorg/nx3-maven-central-deploy)
In my case I am tagging the faulty artifacts, which you can not do with OSS version, but you can still log the problems and possibly do other actions with that.
---
### Author:  [@gaudette](https://community.sonatype.com/u/gaudette)
#### Post date: [January 17, 2025, 9:32pm UTC](https://community.sonatype.com/t/scan-hosted-repositories-for-sensitive-information/14174/3 "2025-01-17T21:32:17Z")
Hello David, thanks for that reply. I’ve started browsing the repository. That’s an interesting project!