guard

Overview ¶

Command guard scans a repository for material that must not be published: private and special IPv4 literals, private-network hostnames and issued credential shapes. It is run in CI as

go run ./internal/tools/guard

and works from any directory inside the repository. Every file tracked by git is scanned; content containing a NUL byte is treated as binary and skipped. Each finding is printed as `path:line: rule: excerpt` and the exit code is 1. Justified exceptions live in `.guard-allow` at the repository root, one `path:regexp` per line.