Documentation
¶
Overview ¶
Package recognize routes parsed input to modules. It combines two sources: gitleaks (the broad net for prefixed/checksummed single strings) and a registry of custom recognizer funcs for the set-shaped and file-shaped credentials gitleaks handles poorly. Modules register their rule mappings and custom recognizers here.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func RegisterRecognizer ¶
func RegisterRecognizer(f RecognizerFunc)
RegisterRecognizer adds a custom recognizer (called by modules in init()).
Types ¶
type Match ¶
type Match struct {
Module string // module name
Fields module.Fields // extracted inputs (token, secret, tenant, endpoint, …)
Secret string // raw secret, for redaction in the note title
Label string // where it came from, e.g. ".env: GITHUB_TOKEN"
Line int // 1-based source line, 0 if unknown
// Overrides lists module names this match supersedes for the same credential
// (matched by secret containment). Lets a structured recognizer suppress a
// broad-net hit that misattributed the same value — e.g. a WorkOS key claimed
// over the gitleaks Stripe rule it collides with.
Overrides []string
}
Match is a recognized credential routed to a module.
func Recognize ¶
Recognize returns all matches for a blob: gitleaks hits routed by rule id, plus every custom recognizer's matches. Matches are deduped by (module, secret) keeping the richest one, and generic "unknown" matches whose value is already consumed by a recognized set/file match are suppressed as noise.
Source Files