finding

Documentation

Overview

Package finding defines the unified result model shared by every scanner.

The whole point of andas is the distinction between two numbers:

• Severity: the theoretical severity of an issue (e.g. a CVSS score, or "this looks like an AWS key"). Every scanner in the world reports this.
• RealRisk: the contextual risk *for this project specifically*, after we ask the expensive question — is this secret actually live? is this vulnerable function actually reachable? That question is andas's job.

Index

• func Redact(secret string) string
• type Context
• type Finding
  • func (f Finding) Fingerprint() string
  • func (f Finding) RealRisk() Severity
• type Kind
• type Severity
  • func (s Severity) String() string

Functions

func Redact

func Redact(secret string) string

Redact keeps a secret printable without leaking it: first 4 and last 2 characters, the middle replaced by a fixed mask.

Types

type Context

type Context struct {
	// Secrets: live-validation evidence.
	Validated bool   `json:"validated"` // did we attempt to verify it?
	Live      bool   `json:"live"`      // is the secret confirmed active?
	Note      string `json:"note,omitempty"`

	// Secrets: blast radius — what a live credential can actually reach. This is
	// the difference between "a live token" and "a live admin token".
	Identity   string   `json:"identity,omitempty"`   // who/what the credential authenticates as
	Access     []string `json:"access,omitempty"`     // scopes/capabilities it grants
	Privileged bool     `json:"privileged,omitempty"` // elevated/admin-level access

	// Secrets: how long the secret has been exposed (from git blame / history).
	Exposure string `json:"exposure,omitempty"`

	// Vulnerabilities: reachability evidence (populated by a later module).
	// nil = not analysed, true = the vulnerable code path is callable.
	Reachable *bool `json:"reachable,omitempty"`

	// Symbols the app actually uses from a vulnerable package (e.g. the lodash
	// functions it imports/calls). Evidence for triage — we deliberately do NOT
	// downgrade on this, since mapping an advisory to exact functions is
	// unreliable and a false "safe" is worse than a false alarm.
	Symbols []string `json:"symbols,omitempty"`
}

Context holds the evidence andas gathers to turn a raw detection into a real-risk judgement. Fields are populated per-Kind.

type Finding

type Finding struct {
	Kind     Kind     `json:"kind"`
	RuleID   string   `json:"rule_id"`
	Title    string   `json:"title"`
	File     string   `json:"file"`
	Line     int      `json:"line"`
	Match    string   `json:"match"` // already redacted, safe to print
	Severity Severity `json:"severity"`
	Fix      string   `json:"fix,omitempty"` // concrete remediation step
	Context  Context  `json:"context"`
}

Finding is a single issue surfaced by a scanner.

func (Finding) Fingerprint

func (f Finding) Fingerprint() string

Fingerprint is a stable identifier for a finding, used by baseline mode to recognise a previously-seen issue across runs. It is built from the rule, the location, and the redacted match — enough to be unique, stable across scans as long as the finding itself doesn't move, and safe to store (the match is already redacted, so no secret material lands in the baseline file).

func (Finding) RealRisk

func (f Finding) RealRisk() Severity

RealRisk is the contextual score andas actually ranks and reports on.

The rule is simple and is the heart of the product: proven-exploitable issues get promoted, proven-harmless ones get demoted into the noise, and everything we couldn't verify keeps its theoretical severity.

type Kind

type Kind string

Kind is the category of a finding.

const (
	KindSecret Kind = "secret"
	KindVuln   Kind = "vulnerability"
)

type Severity

type Severity int

Severity is an ordered risk level.

const (
	SevInfo Severity = iota
	SevLow
	SevMedium
	SevHigh
	SevCritical
)

func (Severity) String

func (s Severity) String() string