Documentation
¶
Overview ¶
Command secretscan refuses content that must never reach this repository, which is public: credentials and tokens, private keys, OpenTofu state and variables, public host addresses, and the literal contents of the secret files on the machine running it (a Hetzner Cloud token has no shape a pattern could know; its bytes do).
secretscan -staged what `git commit` would record (the pre-commit hook)
secretscan -commits A..B every commit in the range, one by one (CI): a
secret added and then deleted is still public
secretscan -tree every tracked file (an audit)
A finding names the file, line and rule, never the matched text: a finding printed into a public CI log would publish what it caught. One line may opt out of the pattern rules with "secretscan:allow"; nothing opts out of the literal check or of the file-name rules.
Exit status: 0 clean, 1 findings, 2 the scan could not run. The summary line states how many files and lines were read, so a clean result is checkable against the population it covers.
Source Files