secretdetect

Documentation

Index

• Constants
• func CalculateEntropy(s string) float64
• func Redact(content string, matches []SecretMatch) string
• func RedactWithPlaceholder(content string, placeholder string, matches []SecretMatch) string
• func TokenizeAndCheckEntropy(line string, threshold float64) []string
• type Detector
• type DetectorImpl
  • func NewDetector() *DetectorImpl
  • func NewEmptyDetector() *DetectorImpl
  • func (d *DetectorImpl) AddPattern(pattern SecretPattern)
  • func (d *DetectorImpl) Scan(content string) []SecretMatch
  • func (d *DetectorImpl) ScanFile(path string) ([]SecretMatch, error)
  • func (d *DetectorImpl) ScanLines(lines []string) []SecretMatch
• type SecretMatch
• type SecretPattern
  • func GetDefaultPatterns() []SecretPattern
• type Severity

Constants

const DefaultEntropyThreshold = 4.5

DefaultEntropyThreshold is a reasonable default for base64-like secrets.

Functions

func CalculateEntropy

func CalculateEntropy(s string) float64

CalculateEntropy calculates the Shannon entropy of a string.

func Redact

func Redact(content string, matches []SecretMatch) string

Redact replaces detected secrets in the content with a default placeholder.

func RedactWithPlaceholder

func RedactWithPlaceholder(content string, placeholder string, matches []SecretMatch) string

RedactWithPlaceholder replaces detected secrets with a custom placeholder.

func TokenizeAndCheckEntropy

func TokenizeAndCheckEntropy(line string, threshold float64) []string

TokenizeAndCheckEntropy splits a line into tokens and returns those exceeding the threshold. This is a simple heuristic approach.

Types

type Detector

type Detector interface {
	Scan(content string) []SecretMatch
	ScanFile(path string) ([]SecretMatch, error)
	AddPattern(pattern SecretPattern)
}

Detector defines the interface for secret detection.

type DetectorImpl

type DetectorImpl struct {
	// contains filtered or unexported fields
}

DetectorImpl implements the Detector interface.

func NewDetector

func NewDetector() *DetectorImpl

NewDetector creates a new detector with default patterns.

func NewEmptyDetector

func NewEmptyDetector() *DetectorImpl

NewEmptyDetector creates a new detector with no patterns.

func (*DetectorImpl) AddPattern

func (d *DetectorImpl) AddPattern(pattern SecretPattern)

AddPattern adds a new pattern to the detector.

func (*DetectorImpl) Scan

func (d *DetectorImpl) Scan(content string) []SecretMatch

Scan scans the provided content for secrets.

func (*DetectorImpl) ScanFile

func (d *DetectorImpl) ScanFile(path string) ([]SecretMatch, error)

ScanFile scans a file for secrets.

func (*DetectorImpl) ScanLines

func (d *DetectorImpl) ScanLines(lines []string) []SecretMatch

ScanLines scans a slice of lines for secrets.

type SecretMatch

type SecretMatch struct {
	PatternName string
	MatchedText string
	LineNumber  int
	Column      int
	FilePath    string
	Confidence  float64 // 0.0 to 1.0
}

SecretMatch represents a detected secret.

type SecretPattern

type SecretPattern struct {
	Name        string
	Regex       *regexp.Regexp
	Description string
	Severity    Severity
}

SecretPattern defines a pattern to search for.

func GetDefaultPatterns

func GetDefaultPatterns() []SecretPattern

GetDefaultPatterns returns a list of common secret patterns.

type Severity

type Severity string

Severity represents the severity level of a detected secret.

const (
	SeverityLow      Severity = "LOW"
	SeverityMedium   Severity = "MEDIUM"
	SeverityHigh     Severity = "HIGH"
	SeverityCritical Severity = "CRITICAL"
)