secrets

Documentation

Index

• type Scanner
  • func NewScanner() (*Scanner, error)
  • func NewScannerConfig(configTOML string) (*Scanner, error)
  • func (s *Scanner) HasFindings(content []byte) bool
  • func (s *Scanner) ScanBytes(content []byte, filePath string) []SecretFinding
  • func (s *Scanner) ScanString(content string, filePath string) []SecretFinding
• type SecretFinding

Types

type Scanner

type Scanner struct {
	// contains filtered or unexported fields
}

Scanner wraps the gitleaks detector.

func NewScanner

func NewScanner() (*Scanner, error)

NewScanner creates a scanner with the best available rule set. Tries betterleaks 269-rule config first, falls back to gitleaks 150-rule default.

func NewScannerConfig

func NewScannerConfig(configTOML string) (*Scanner, error)

NewScannerConfig creates a scanner from a custom TOML config string.

func (*Scanner) HasFindings

func (s *Scanner) HasFindings(content []byte) bool

HasFindings returns true if there are any secrets detected.

func (*Scanner) ScanBytes

func (s *Scanner) ScanBytes(content []byte, filePath string) []SecretFinding

ScanBytes scans raw content and returns findings.

func (*Scanner) ScanString

func (s *Scanner) ScanString(content string, filePath string) []SecretFinding

ScanString scans a string and returns findings.

type SecretFinding

type SecretFinding struct {
	RuleID      string  `json:"rule_id"`
	Description string  `json:"description"`
	Line        int     `json:"line"`
	Column      int     `json:"column"`
	Secret      string  `json:"secret"`
	Entropy     float64 `json:"entropy"`
	Severity    string  `json:"severity"`
	Message     string  `json:"message"`
	FilePath    string  `json:"file_path,omitempty"` // populated in directory mode for SARIF
}

SecretFinding represents a detected secret with AI guidance.