Documentation
¶
Overview ¶
Package gcp provides a verifier for GCP service account keys.
It validates the JSON structure without making any API calls. Because no live verification is performed, the result is always StatusUnverified: a valid structure does not prove the key is active, and an invalid structure does not prove it is inactive.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Verifier ¶
type Verifier struct{}
Verifier checks whether a GCP service account key has a valid JSON structure. It NEVER logs or persists raw key values.
func (*Verifier) Verify ¶
func (v *Verifier) Verify(ctx context.Context, raw detector.RawFinding) finding.VerificationResult
Verify checks if the detected GCP service account key has a valid JSON structure.
The detector puts the redacted service-account JSON block (the private_key PEM body replaced with "[REDACTED]", structure intact) in RawV2 and only the private_key_id in Raw. Validation therefore uses RawV2 when present, falling back to Raw for older/alternate detector output. The "[REDACTED]" placeholder does not affect the type/project_id/private_key_id/client_email checks.
Source Files