detector

package
v1.7.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 19, 2026 License: MIT Imports: 7 Imported by: 0

Documentation

Overview

Package detector defines secret detection interfaces.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func HasAnyKeyword added in v1.7.0 

func HasAnyKeyword(data []byte, keywords ...string) bool

HasAnyKeyword reports whether data contains any of the given keywords, matched case-insensitively. It is intended for detectors that gate a broad regex behind a context check confirming a domain-specific keyword is present nearby, so callers do not need to hand-enumerate case variants.

func Redact 

func Redact(value string) string

Redact returns a uniformly redacted representation of a secret value.

The scheme is deliberately simple and consistent across every detector: reveal at most the last revealedSuffixLen characters of the value and never any leading body characters. The result is always "****" followed by the revealed suffix, e.g. Redact("AKIA1234567890ABCD") == "****ABCD".

Detectors that match a value behind a FIXED literal prefix (for example a regex anchored on "sk-ant-") may prepend that constant prefix themselves; the prefix is part of the pattern, not secret-derived, so it leaks nothing. When in doubt prefer the bare "****"+suffix form.

Redact never reveals the full value: if the value is shorter than or equal to revealedSuffixLen the entire value is masked. The suffix is measured and sliced in runes, not bytes, so the revealed portion is always valid UTF-8 even when the value contains multi-byte characters near its end.

func RedactBytes 

func RedactBytes(value []byte) string

RedactBytes is the []byte convenience wrapper around Redact. It does not log, store, or otherwise retain the input beyond computing the redacted suffix.

func RedactURLPassword added in v1.7.0 

func RedactURLPassword(raw string) string

RedactURLPassword redacts the password component of a URL-shaped credential string (e.g. "amqp://user:pass@host:5672/vhost"), keeping the scheme, username, host and path visible for correlation while masking the secret.

It is fail-safe: it NEVER returns the raw input unmodified. If the value cannot be parsed as a URL, or net/url finds no userinfo component in the authority (a credential may still be embedded elsewhere in the matched text, e.g. in the path or query, since detector regexes typically only exclude whitespace and quotes), the value is masked down to at most the scheme rather than risk echoing a cleartext credential.

func Register 

func Register(d Detector)

Register adds a detector to the central registry. Each detector package calls this in its init() function. Panics if a duplicate ID is registered.

func RegisterIfAbsent 

func RegisterIfAbsent(d Detector) bool

RegisterIfAbsent registers d only if its ID is not already taken, atomically. It returns true when the detector was registered and false when an entry with the same ID already existed. Unlike Register it never panics, which makes it safe for runtime-supplied detectors such as user-defined custom rules.

func Reset 

func Reset()

Reset clears all registered detectors. For testing only.

Types

type Detector 

type Detector interface {
	// ID returns the unique identifier (e.g., "aws-access-key-id").
	ID() string

	// Description returns a human-readable description.
	Description() string

	// Keywords returns Aho-Corasick pre-filter keywords.
	// If empty, pre-filtering is skipped and regex is applied to every chunk.
	Keywords() []string

	// Scan scans the given data and returns potential secret findings.
	Scan(ctx context.Context, data []byte) []RawFinding

	// Severity returns the default severity for findings from this detector.
	Severity() finding.Severity
}

Detector represents a component that detects a specific secret type.

func All 

func All() []Detector

All returns all registered detectors sorted by ID.

func Get 

func Get(id string) (Detector, bool)

Get returns the detector with the given ID.

type RawFinding 

type RawFinding struct {
	DetectorID string
	Raw        []byte
	RawV2      []byte
	Redacted   string
	ExtraData  map[string]string
}

RawFinding represents an unverified raw finding.

Source Files

View all Source files

Directories

Path Synopsis
Package airtable provides an Airtable Personal Access Token secret detector.
 Package airtable provides an Airtable Personal Access Token secret detector.
Package anthropic provides an Anthropic API Key secret detector.
 Package anthropic provides an Anthropic API Key secret detector.
Package auth0 provides an Auth0 Management API Token secret detector.
 Package auth0 provides an Auth0 Management API Token secret detector.
Package aws provides AWS-related secret detectors.
 Package aws provides AWS-related secret detectors.
Package azure provides Azure secret detectors.
 Package azure provides Azure secret detectors.
Package bitbucket provides a Bitbucket App Password secret detector.
 Package bitbucket provides a Bitbucket App Password secret detector.
Package circleci provides a CircleCI Personal API Token secret detector.
 Package circleci provides a CircleCI Personal API Token secret detector.
Package cloudflare provides a Cloudflare API Token secret detector.
 Package cloudflare provides a Cloudflare API Token secret detector.
Package coinbase provides a Coinbase API Key secret detector.
 Package coinbase provides a Coinbase API Key secret detector.
Package custom provides a YAML-based custom rule detector.
 Package custom provides a YAML-based custom rule detector.
Package databricks provides a Databricks Personal Access Token secret detector.
 Package databricks provides a Databricks Personal Access Token secret detector.
Package datadog provides a Datadog API Key secret detector.
 Package datadog provides a Datadog API Key secret detector.
Package dbconn provides a detector for database connection strings.
 Package dbconn provides a detector for database connection strings.
Package deepseek provides a DeepSeek API Key secret detector.
 Package deepseek provides a DeepSeek API Key secret detector.
Package digitalocean provides a DigitalOcean Personal Access Token secret detector.
 Package digitalocean provides a DigitalOcean Personal Access Token secret detector.
Package discord provides a Discord Bot Token secret detector.
 Package discord provides a Discord Bot Token secret detector.
Package dockerhub provides a Docker Hub Personal Access Token secret detector.
 Package dockerhub provides a Docker Hub Personal Access Token secret detector.
Package doppler provides a Doppler Service Token secret detector.
 Package doppler provides a Doppler Service Token secret detector.
Package figma provides a Figma Personal Access Token secret detector.
 Package figma provides a Figma Personal Access Token secret detector.
Package ftp provides an FTP/SFTP Credentials secret detector.
 Package ftp provides an FTP/SFTP Credentials secret detector.
Package gcp provides a GCP Service Account Key secret detector.
 Package gcp provides a GCP Service Account Key secret detector.
Package generic provides general-purpose secret detectors.
 Package generic provides general-purpose secret detectors.
Package github provides detectors for GitHub secret types.
 Package github provides detectors for GitHub secret types.
Package gitlab provides a GitLab Personal Access Token secret detector.
 Package gitlab provides a GitLab Personal Access Token secret detector.
Package grafana provides a Grafana API Key secret detector.
 Package grafana provides a Grafana API Key secret detector.
Package heroku provides a Heroku API Key secret detector.
 Package heroku provides a Heroku API Key secret detector.
Package huggingface provides a Hugging Face API Token secret detector.
 Package huggingface provides a Hugging Face API Token secret detector.
Package infura provides an Infura API Key secret detector.
 Package infura provides an Infura API Key secret detector.
Package jwt provides a detector for JSON Web Tokens.
 Package jwt provides a detector for JSON Web Tokens.
Package launchdarkly provides a LaunchDarkly SDK Key secret detector.
 Package launchdarkly provides a LaunchDarkly SDK Key secret detector.
Package ldap provides an LDAP/LDAPS Bind Credentials secret detector.
 Package ldap provides an LDAP/LDAPS Bind Credentials secret detector.
Package linear provides a Linear API Key secret detector.
 Package linear provides a Linear API Key secret detector.
Package mailgun provides a Mailgun API Key secret detector.
 Package mailgun provides a Mailgun API Key secret detector.
Package newrelic provides a New Relic API Key secret detector.
 Package newrelic provides a New Relic API Key secret detector.
Package notion provides a Notion Internal Integration Token secret detector.
 Package notion provides a Notion Internal Integration Token secret detector.
Package npm provides an NPM Access Token secret detector.
 Package npm provides an NPM Access Token secret detector.
Package okta provides an Okta API Token secret detector.
 Package okta provides an Okta API Token secret detector.
Package openai provides an OpenAI API Key secret detector.
 Package openai provides an OpenAI API Key secret detector.
Package pagerduty provides a PagerDuty API Key secret detector.
 Package pagerduty provides a PagerDuty API Key secret detector.
Package postmark provides a Postmark Server API Token secret detector.
 Package postmark provides a Postmark Server API Token secret detector.
Package privatekey provides private key detectors.
 Package privatekey provides private key detectors.
Package pypi provides a PyPI API Token secret detector.
 Package pypi provides a PyPI API Token secret detector.
Package rabbitmq provides a RabbitMQ Connection String secret detector.
 Package rabbitmq provides a RabbitMQ Connection String secret detector.
Package redis provides a Redis Connection String secret detector.
 Package redis provides a Redis Connection String secret detector.
Package rubygems provides a RubyGems API Key secret detector.
 Package rubygems provides a RubyGems API Key secret detector.
Package sendgrid provides a SendGrid API Key secret detector.
 Package sendgrid provides a SendGrid API Key secret detector.
Package sentry provides a Sentry Auth Token secret detector.
 Package sentry provides a Sentry Auth Token secret detector.
Package shopify provides a Shopify Access Token secret detector.
 Package shopify provides a Shopify Access Token secret detector.
Package slack provides detectors for Slack secret types.
 Package slack provides detectors for Slack secret types.
Package snowflake provides a Snowflake Connection Credentials secret detector.
 Package snowflake provides a Snowflake Connection Credentials secret detector.
Package snyk provides a Snyk API Key secret detector.
 Package snyk provides a Snyk API Key secret detector.
Package sonarcloud provides a SonarCloud/SonarQube Token secret detector.
 Package sonarcloud provides a SonarCloud/SonarQube Token secret detector.
Package stripe provides detectors for Stripe secret types.
 Package stripe provides detectors for Stripe secret types.
Package supabase provides a Supabase Service Role Key secret detector.
 Package supabase provides a Supabase Service Role Key secret detector.
Package teams provides a Microsoft Teams Incoming Webhook URL secret detector.
 Package teams provides a Microsoft Teams Incoming Webhook URL secret detector.
Package telegram provides a Telegram Bot Token secret detector.
 Package telegram provides a Telegram Bot Token secret detector.
Package terraform provides a Terraform Cloud/Enterprise API Token secret detector.
 Package terraform provides a Terraform Cloud/Enterprise API Token secret detector.
Package testutil provides shared helpers for detector tests.
 Package testutil provides shared helpers for detector tests.
Package twilio provides a Twilio API Key secret detector.
 Package twilio provides a Twilio API Key secret detector.
Package vault provides a HashiCorp Vault Token secret detector.
 Package vault provides a HashiCorp Vault Token secret detector.
Package vercel provides a Vercel API Token secret detector.
 Package vercel provides a Vercel API Token secret detector.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.