scan

package
v0.9.5 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 1, 2026 License: MIT Imports: 9 Imported by: 0

Documentation

Overview

Package scan implements the secret detection engine used by the envault pre-commit hook and the `envault scan` CLI command. It provides pattern-based rules and a Shannon-entropy heuristic for finding plaintext credentials in unified diffs and tracked file trees.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func LoadIgnorePatterns 

func LoadIgnorePatterns(repoRoot string) ([]string, error)

LoadIgnorePatterns reads .envaultignore from repoRoot and returns the glob patterns. Returns nil (not an error) when the file does not exist.

func SeverityAtLeast 

func SeverityAtLeast(s, min Severity) bool

SeverityAtLeast reports whether s is at or above min in the severity order.

Types

type Match 

type Match struct {
	File        string
	Line        int // 0 for file-level matches
	RuleID      string
	Description string
	Severity    Severity
	Snippet     string // truncated matched content or file path
}

Match is a single detection result.

func ScanDiff 

func ScanDiff(diff string, rules []Rule, ignoredFiles []string) []Match

ScanDiff scans a unified diff (e.g. from `git diff --cached -U0`) for secrets. ignoredFiles contains gitignore-style glob patterns from .envaultignore.

func ScanFiles 

func ScanFiles(repoRoot string, rules []Rule, ignoredFiles []string) ([]Match, error)

ScanFiles scans all git-tracked files under repoRoot for secrets.

type Rule 

type Rule struct {
	ID          string
	Description string
	Pattern     *regexp.Regexp
	Severity    Severity
	FileLevel   bool // match file name rather than line content
}

Rule is a single secret-detection rule.

func DefaultRules 

func DefaultRules() []Rule

DefaultRules returns the built-in detection ruleset.

type Severity 

type Severity string

Severity represents the urgency of a detected finding. 

const (
	SeverityCritical Severity = "critical"
	SeverityHigh     Severity = "high"
	SeverityMedium   Severity = "medium"
)

func ParseSeverity 

func ParseSeverity(s string) Severity

ParseSeverity converts a string to Severity; unknown values default to High.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.