Documentation
¶
Overview ¶
Package secretdetect provides secret detection backed by the gitleaks detection engine. It exposes a small Scanner interface so callers can detect (and optionally redact) secrets in arbitrary text without depending directly on gitleaks types.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DisplayName ¶
DisplayName returns a user-facing label for a gitleaks rule ID. For known rules it returns a curated string; for unknown rules it title-cases the dash-separated segments and expands common abbreviations.
func Redact ¶
Redact returns content with each match's secret value replaced by a self-disclosing token of the form
[REDACTED:rule=<ruleID>,len=<n>,entropy=<x.x>]
The token carries enough metadata that a downstream LLM reader can distinguish "this file actually contained a secret" from "the display layer matched a pattern that happened to look like a secret." Replacements are applied longest-first so overlapping secrets don't produce partial matches.
If a match's Secret is empty (rule has no SecretGroup), Match is used.
func RedactOpaque ¶
RedactOpaque scans content with the default scanner and replaces every detected secret with the literal token [REDACTED]. Use this for log files, training exports, CLI display, and other paths where the consumer is a human (or non-LLM tool) and self-disclosing metadata would either be noise or a leak of original-value shape information.
For tool output that an LLM agent will read, use Redact instead so the agent can distinguish display-layer redactions from on-disk content.
If the default scanner cannot be initialised, content is returned unchanged.
func RedactTagged ¶
RedactTagged scans content with the default scanner and replaces every detected secret with [REDACTED:<rule-id>]. Use this for log files and debugging contexts where it's useful to know the *kind* of secret that was present without exposing its value, length, or entropy.
If the default scanner cannot be initialised, content is returned unchanged.
Types ¶
type Match ¶
type Match struct {
RuleID string // gitleaks rule ID (e.g. "openai-api-key", "generic-api-key")
Match string // the broader matched substring (rule-defined; may include the var name)
Secret string // the extracted secret value (the part to actually redact)
StartLine int // 1-based line number of the match
StartCol int
EndLine int
EndCol int
Entropy float32 // Shannon entropy of the secret as computed by gitleaks
}
Match describes a single secret detected in input text.
Source Files