triage

package

v1.2.0 Latest Latest Go to latest Published: Oct 17, 2026 License: Apache-2.0 Imports: 14 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/AISolutionLabs/secret-scanner

Links

Open Source Insights

Documentation ¶

Overview ¶

Package triage is a precision layer for other scanners: it re-scores findings from gitleaks, trufflehog or any SARIF producer using secretscan's context analysis and evidence model.

Guarantees:

verified findings are always kept as high confidence;
a finding is only marked "filtered" with an explicit, named reason, and filtered findings are still returned (never silently dropped);
anything that cannot be evaluated (redacted secret, unreadable file, no applicable evidence) is kept as "uncorroborated", not passed.

Index ¶

Constants
type Input
- func Parse(data []byte) (string, []Input, error)
type Triager
- func New(det *detect.Detector, root string) *Triager
- func (t *Triager) Evaluate(in Input) detect.Finding

Constants ¶

View Source

const (
	Confirmed      = "confirmed"      // secretscan independently reports the same secret
	Verified       = "verified"       // the source tool verified it live
	Filtered       = "filtered"       // positively identified as noise (reason given)
	Uncorroborated = "uncorroborated" // no evidence either way: kept for review
)

Statuses.

View Source

const (
	// Conservative never filters a value only because of its shape when the
	// line assigns it to a credential-named key (token, secret, password, key,
	// auth, ...): a UUID or a word-like string can be a real credential.
	Conservative = "conservative"
	// Standard applies every filter, as a scan does.
	Standard = "standard"
)

Triage modes.

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type Input ¶

type Input struct {
	Tool, RuleID, File, Commit, Secret, Match, Line string
	StartLine, EndLine                              int
	Verified                                        bool
	Redacted                                        bool
	// Prefix is the visible part of a partially redacted secret
	// (gitleaks --redact=N gives "abc...", secretscan gives "abcREDACTED").
	Prefix string
	// Unresolved explains why the report does not identify one source
	// location (for example trufflehog metadata naming several that
	// disagree). Such a finding is never checked against any file.
	Unresolved string
}

Input is one foreign finding.

func Parse ¶

func Parse(data []byte) (string, []Input, error)

Parse auto-detects gitleaks JSON, trufflehog JSON lines or SARIF.

type Triager ¶

type Triager struct {
	Det  *detect.Detector // must have RecordSuppressed set
	Root string

	Mode string // Conservative (default) or Standard
	// MaxSource caps how much of one source file triage reads (default
	// 8 MiB); larger files stay uncorroborated without being loaded.
	MaxSource int64
	// contains filtered or unexported fields
}

Triager re-scores findings against source files under Root.

func New ¶

func New(det *detect.Detector, root string) *Triager

New returns a triager.

func (*Triager) Evaluate ¶

func (t *Triager) Evaluate(in Input) detect.Finding

Evaluate re-scores one foreign finding.

Source Files ¶

View all Source files

triage.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL