Documentation
¶
Overview ¶
Package secrets is the one credential-shaped-string rule set, shared by the two places that look: the hub's share gate (internal/webapp/shares.go, which refuses to mint) and the sync scan (internal/syncer, which only warns). It imports the standard library and nothing else, so the syncer can use it without depending on the server.
Both callers say the same thing about time: the check ran when the bytes were read — at the moment you shared it, or the moment the file last changed. Neither one ever claims a file is clean.
The matched text never leaves this package. Rule ids and line numbers only, in a 409 body, in `bdrive status`, in an agent's context, in a log line.
Index ¶
Constants ¶
const ScanLimit = 1 << 20
ScanLimit is how much of a file the share gate reads. The boundary is a decision, not an accident: a key past the first MiB mints silently, which is asserted in shares_test.go so nobody "fixes" it by accident.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Finding ¶
Finding is one credential-shaped string: which rule fired, and where. Never the matched text — see Scan.
func Scan ¶
Scan reports credential-shaped strings in buf, as rule ids and line numbers ONLY. The matched text must never reach a response body, a log line, or a metric label — the same argument reads.go:28-40 makes for actor identity, and a 409 body is the easiest place in the codebase to leak it.
Byte-oriented on purpose: a bufio.Scanner over a 1 MiB minified file with no newline blows its 64 KiB token limit and returns nothing at all, which is a check that silently passes everything.
Source Files