Bulk scan
Scan the issues that already exist. Start small.
What it does. Real-time scanning only sees what changes from now on. A bulk scan looks at issues that are already in your instance, chosen by a JQL query.
Jira → Apps → Secret Scanner → Bulk ScanIllustration
Bulk Scan
Scan existing Jira issues for exposed secrets, credentials and PII using a JQL query.
FindingsDismissedBulk ScanAnalyticsScanning RulesProject ExclusionsSettingsAudit Log
JQL
project in (SUP, OPS) AND created >= -365d ORDER BY created DESC
The scan walks the result set in batches. Validate the query before starting.
Validate JQLStart Bulk ScanReset
Scanning — 2,140 of 3,806 issues
7 new findings so far · running in the background, safe to leave this page
How to run one
- 1Open the Bulk Scan tab.
- 2Write a JQL query for the issues to cover and click Validate. A query is rejected if it matches nothing, or more than 1,000 issues — the per-scan maximum.
- 3Optionally override the scan settings for this run only: the changelog, attachment and auto-redaction switches and the whole category and rule tree are repeated on this tab, pre-filled from your saved configuration.
- 4Click Start Scan (N issues). It runs in batches in the background, so you can close the page.
- 5Watch progress and the count of new findings. Review them on the Findings tab.
- 6Cancel Scan stops a running scan; Scan Again clears a finished one. Cancelling discards the remaining queue — there is no resume.
Queries worth using
-- Start here: one project, three months
project = SUP AND created >= -90d
-- Widen in slices that stay under 1,000 issues
project = SUP AND created >= -365d AND created < -90d
-- Anywhere someone pasted a configuration block
text ~ "BEGIN RSA PRIVATE KEY" OR text ~ "connectionString"Scan in slices, not all at once
A first scan over a large instance produces a backlog nobody works through. Go project by project, or year by year. You will also spot a noisy category early and switch it off before it fills the queue with false positives.
Why the scan can see projects you cannot
The scanner reads issues with the app's own access, so a bulk scan covers every project in the query even if you personally cannot browse it. That is deliberate: an exposed key in a project you cannot see is still an exposed key. It is also why these screens are restricted to Jira administrators.