Documentation
¶
Overview ¶
Package redact masks secret material so it never appears in Geiger output.
Index ¶
Constants ¶
const Placeholder = "REDACTED-BY-GEIGER"
Placeholder is what the redact mode writes over a secret in a file. It is plain ASCII with no quote, slash, or whitespace, so a JSON, YAML, INI, or dotenv file stays parseable, and recognition drops it, so a second scan of a redacted tree stays clean.
Variables ¶
This section is empty.
Functions ¶
func Line ¶
Line redacts any credential-shaped substring inside free text, so accidental echoes of a raw secret in a log line or error message are masked.
Length alone does not make a run a secret. A media type, a reverse-DNS identifier and a package path are all long, and masking them destroys the thing the reader came for — an audit line that reads "Accept: …json, …ream" says nothing. Known secrets are replaced exactly before this runs (see recon.Client.scrub); this pass is the net for the ones nobody registered, so it masks only what has the shape of one.
Types ¶
This section is empty.
Source Files