Documentation
¶
Overview ¶
Package secretscan holds the credential-shaped string patterns that every outbound artifact is checked against before it is written.
It lives on its own because more than one surface produces something a user may hand to someone else — a snapshot database, a team config file — and those surfaces have nothing else in common. Whichever one had owned the patterns would have become an accidental dependency of the others.
The Atlassian and Linear token patterns must not disagree with scripts/scan-internal.sh, which guards the repository itself.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Match ¶
Match reports the name of the first credential-shaped pattern found in s, or "" when none match. Callers report the name and never the value: a diagnostic that quotes the secret has published it a second time.
Email addresses are deliberately not a pattern here. A mirror legitimately carries assignee emails, and treating them as secrets would refuse every real snapshot.
Types ¶
type Pattern ¶ added in v0.19.0
Pattern is one row of the credential-shape table: the name Match reports and the regexp that recognizes it.
func Patterns ¶ added in v0.19.0
func Patterns() []Pattern
Patterns returns the pattern table for surfaces that erase rather than refuse — internal/applog composes its log scrubber over it, so the two lists cannot drift apart silently (the applog corpus test fails until a new pattern name is covered there). The slice is shared with Match; treat it as read-only.
Source Files