portcullis-scan

Overview ¶

Command portcullis-scan walks a directory tree and prints every secret occurrence found in regular files, as detected by portcullis.Find.

Output is grep-like, one match per line:

<path>:<line>:<col>: <value>

Paths are relative to the scan root. Newlines and carriage returns inside a matched value are collapsed to spaces so each match remains on a single line; this only affects display, not detection. Files are scanned in parallel; output order matches the walker's lexical order, so two runs over the same tree produce identical output regardless of worker count or scheduling.

Usage:

portcullis-scan [flags] <path>

Flags:

-max-size    skip files larger than this many bytes (default 10 MiB).
-workers     parallel worker count (default GOMAXPROCS).
-binary      also scan binary files (default: skipped, like ripgrep).
             A file is considered binary when its first 8 KiB
             contains a NUL byte.
-ignore      glob pattern to skip; repeatable. Patterns containing
             '/' are anchored to the scan root, others match
             basenames. '**' matches any run of characters,
             including separators. Trailing '/' restricts the
             rule to directories. Examples: -ignore '*_test.go'
             -ignore 'vendor/**' -ignore 'node_modules/'

Exit codes:

0  scan completed; no secrets found.
1  scan completed; at least one secret was found.
2  invocation error (bad flags, unreadable root, etc.) or one
   or more files could not be read.