Documentation
¶
Overview ¶
Package secretsscan recognises common API tokens, cloud credentials, and other secret material in arbitrary text.
ContainsSecrets reports whether any rule matches the input; Redact replaces every detected secret span with RedactionMarker while preserving the surrounding text. Both are safe for concurrent use and idempotent.
The ruleset is derived from the MIT-licensed github.com/docker/mcp-gateway/pkg/secretsscan package, which adapted it from github.com/aquasecurity/trivy/pkg/fanal/secret.
Index ¶
Constants ¶
const RedactionMarker = "[REDACTED]"
RedactionMarker replaces every detected secret span. Chosen so it doesn't match any rule's keyword pre-filter — see TestRedactionMarkerIsNotASecret for the safety property that makes Redact idempotent.
Variables ¶
This section is empty.
Functions ¶
func ContainsSecrets ¶
ContainsSecrets reports whether text matches any detection rule.
func Redact ¶
Redact returns a copy of text with every detected secret span replaced by RedactionMarker. When a rule defines a (?P<secret>…) named subgroup, only that span is replaced (so callers still see "AWS_SECRET_ACCESS_KEY=[REDACTED]"); otherwise the whole match is replaced.
Idempotent: RedactionMarker does not match any rule, so calling Redact twice yields the same result.
Types ¶
This section is empty.
Source Files