Documentation
¶
Overview ¶
Package secrets is the engine module wrapper around internal/secrets. It runs the secret-detection engine against Dockerfiles, filesystems, and images (layer-aware, including content deleted by a later layer) and projects each Detection into the unified Finding model. Findings are value-free: they carry a fingerprint, type, location, and verification state — never the secret.
Optional behaviour is driven entirely by Target.Metadata, so the CLI/HTTP frontends can toggle it without any new plumbing and every run stays reproducible:
secrets.classifier=true enable the semantic entropy sweep (off by default) secrets.verify=true enable opt-in live verification (network!) secrets.baseline=<path> suppress findings accepted in a baseline file
Verification is the only feature that touches the network and is off unless explicitly requested; tests never enable it.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Command ¶
Command implements the `dsecrat secrets` subcommand surface. Today it exposes honeytoken generation — decoy credentials to plant in images or repos so any later *use* of them is a high-confidence intrusion signal. The master wires this into cli.go (see NOTES.md); the body lives here to keep the CLI file out of this phase's lane.
Usage:
dsecrat secrets honeytoken --label <name> [--count N]
Output is a decoy value plus its fingerprint. The value is intentionally printable: it is not a real secret, it is a tripwire you embed on purpose.
Types ¶
type Module ¶
type Module struct{}
Module is the secret-detection capability (CAPABILITY_SPEC domain 7).
func (*Module) Analyze ¶
Analyze dispatches on target type, runs the scanner, and maps detections to findings. A failure to load the target is returned as an error; a scanner that simply finds nothing returns no findings and no error.
Source Files