Documentation
¶
Overview ¶
Package verify optionally checks whether detected secrets are live by calling the issuing provider's read-only identity endpoint.
Verification sends the secret to its provider. It is off by default and should never run from a commit hook.
Index ¶
Constants ¶
View Source
const ( Verified = "verified" // provider accepted the credential Invalid = "invalid" // provider rejected it Unknown = "unverified" // no verifier, or inconclusive response Errored = "error" // network/transport failure )
Status values.
Variables ¶
View Source
var Checks = map[string]Check{ "github-pat": {Method: "GET", URL: "https://api.github.com/user", Header: githubHeader, SelfHosted: true, Success: []string{"login", "id"}}, "github-fine-grained-pat": {Method: "GET", URL: "https://api.github.com/user", Header: githubHeader, SelfHosted: true, Success: []string{"login", "id"}}, "github-oauth": {Method: "GET", URL: "https://api.github.com/user", Header: githubHeader, SelfHosted: true, Success: []string{"login", "id"}}, "github-app-token": {Method: "GET", URL: "https://api.github.com/installation/repositories", Header: githubHeader, SelfHosted: true, Success: []string{"total_count"}}, "gitlab-pat": {Method: "GET", URL: "https://gitlab.com/api/v4/user", SelfHosted: true, Success: []string{"id", "username"}, Header: func(s string) http.Header { return http.Header{"Private-Token": {s}} }}, "slack-bot-token": {Method: "POST", URL: "https://slack.com/api/auth.test", Header: bearer, Interpret: slackOK}, "slack-user-token": {Method: "POST", URL: "https://slack.com/api/auth.test", Header: bearer, Interpret: slackOK}, "slack-app-token": {Method: "POST", URL: "https://slack.com/api/apps.connections.open", Header: bearer, Interpret: slackOK}, "stripe-key": {Method: "GET", URL: "https://api.stripe.com/v1/balance", Success: []string{"object=balance"}, Basic: func(s string) (string, string) { return s, "" }}, "openai-api-key": {Method: "GET", URL: "https://api.openai.com/v1/models", Header: bearer, Success: []string{"object=list", "data"}}, "anthropic-api-key": {Method: "GET", URL: "https://api.anthropic.com/v1/models", Success: []string{"data", "has_more"}, Header: func(s string) http.Header { return http.Header{"X-Api-Key": {s}, "Anthropic-Version": {"2023-06-01"}} }}, "huggingface-token": {Method: "GET", URL: "https://huggingface.co/api/whoami-v2", Header: bearer, Success: []string{"name", "type"}}, "npm-access-token": {Method: "GET", URL: "https://registry.npmjs.org/-/whoami", Header: bearer, Success: []string{"username"}}, "sendgrid-api-key": {Method: "GET", URL: "https://api.sendgrid.com/v3/scopes", Header: bearer, Success: []string{"scopes"}}, "digitalocean-token": {Method: "GET", URL: "https://api.digitalocean.com/v2/account", Header: bearer, Success: []string{"account.uuid"}}, "groq-api-key": {Method: "GET", URL: "https://api.groq.com/openai/v1/models", Header: bearer, Success: []string{"object=list", "data"}}, "linear-api-key": {Method: "POST", URL: "https://api.linear.app/graphql", Success: []string{"data.viewer.id"}, Header: func(s string) http.Header { return http.Header{"Authorization": {s}, "Content-Type": {"application/json"}} }}, }
Checks maps rule IDs to verifiers. Endpoints are read-only identity calls.
Functions ¶
This section is empty.
Types ¶
type Check ¶
type Check struct {
Method string
URL string
Header func(secret string) http.Header
Basic func(secret string) (user, pass string)
// Interpret overrides status-code handling (e.g. Slack returns 200 + ok:false).
Interpret func(status int, body []byte) string
// Success lists JSON fields a genuine success response from this provider
// always contains (dot paths, e.g. "data.viewer.id"). A 2xx answer
// without them, such as a JSON error object or an empty document from a
// proxy, proves nothing and is reported as unverified.
Success []string
// SelfHosted marks token formats that self-managed instances issue too
// (GitHub Enterprise Server, GitLab self-managed): a 401 from the public
// endpoint only means "not a token of the SaaS", so it is unknown, not
// invalid.
SelfHosted bool
}
Check describes how to verify one rule's secrets.
type Verifier ¶
type Verifier struct {
Client *http.Client
Timeout time.Duration
// contains filtered or unexported fields
}
Verifier runs checks with caching and bounded concurrency. Each secret is checked at most once per run: concurrent callers for the same rule and secret wait for the one request in flight and share its result.
func New ¶
func New() *Verifier
New returns a verifier honoring HTTPS_PROXY and the system CA store.
Source Files
Click to show internal directories.
Click to hide internal directories.