Documentation
¶
Overview ¶
Package dbrecon runs read-only data-plane recon against a database connection string. Enforcement is structural: each engine runs ONLY a fixed allowlist of catalog/metadata queries (no user input is ever interpolated), and the session is put into read-only mode where the engine supports it.
This path is separate from the HTTP recon client because it speaks native DB protocols; the consent gate (--intrusive) and dry-run check live in the calling module, which only invokes Recon when both Live and Intrusive hold.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func IsAuthError ¶
IsAuthError reports whether a recon error is an authentication rejection (the server reached us and refused the credential) as opposed to a network/reach failure (which says nothing about the credential's validity). It is used to classify a credential as DEAD only when it was actually rejected.
We deliberately do NOT treat "unauthorized"/"not authorized" as an auth failure: those mean the credential authenticated but lacks privilege — i.e. it is valid. Matching is on stable SQLSTATE/driver codes plus engine-specific rejection phrases.
func Recon ¶
Recon connects read-only and returns live catalog findings. The caller must have already confirmed Live && Intrusive.
func ReconSQLiteFile ¶
ReconSQLiteFile opens a SQLite database file read-only and reports what's in it: the table count, and a row count for any sensitively-named table. The path must already be absolute (the caller resolves it against the source file's directory). Read-only by construction: opened mode=ro with query_only, and only SELECT/metadata queries run.
Types ¶
type KVSecret ¶
type KVSecret struct{ Key, Value string }
KVSecret is one plaintext key/value row pulled from an IDE token store.
func ReconVSCDBFile ¶
ReconVSCDBFile reads a VS Code / Cursor "state.vscdb" — a plaintext SQLite key/value store (ItemTable) that AI IDEs use to hold OAuth/access tokens with no isolation — and reports which credential keys it holds, returning the plaintext token values for re-triage. Read-only by construction (mode=ro, query_only) against a fixed key allowlist (no user input interpolated). Encrypted/binary values are skipped: plaintext stores only, never OS-keychain decryption.
Source Files