internal/

Package config defines the scanner configuration schema (a superset of the gitleaks v8 TOML format), loads and merges configs, and compiles rules.

Package detect runs compiled rules over text fragments and produces findings.

Package remediate turns findings into actionable guidance: how urgent it is, how to rotate the credential, how to stop needing it at all (keyless / workload identity), and how to load it efficiently in the file's language.

Package report renders findings as text, JSON, SARIF, CSV or JUnit XML.

Package sources turns files, git history and diffs into fragments.

Package toml implements a dependency-free parser for the subset of TOML v1.0 used by scanner configuration files (including gitleaks-style configs): tables, arrays of tables, dotted and quoted keys, all four string forms, integers, floats, booleans, nested/multi-line arrays and inline tables.

Package triage is a precision layer for other scanners: it re-scores findings from gitleaks, trufflehog or any SARIF producer using secretscan's context analysis and evidence model.

Package verify optionally checks whether detected secrets are live by calling the issuing provider's read-only identity endpoint.

Package wordy scores how much a string reads like natural-language or programming words, using a character-bigram model.