Documentation
¶
Overview ¶
Package secretdetect provides secret detection backed by the gitleaks detection engine. It exposes a small Scanner interface so callers can detect (and optionally redact) secrets in arbitrary text without depending directly on gitleaks types.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DisplayName ¶
DisplayName returns a user-facing label for a gitleaks rule ID. For known rules it returns a curated string; for unknown rules it title-cases the dash-separated segments and expands common abbreviations.
func Redact ¶
Redact returns content with each match's secret value replaced by a self-disclosing token of the form
[REDACTED:rule=<ruleID>,len=<n>,entropy=<x.x>]
The token carries enough metadata that a downstream LLM reader can distinguish "this file actually contained a secret" from "the display layer matched a pattern that happened to look like a secret." Replacements are applied longest-first so overlapping secrets don't produce partial matches.
If a match's Secret is empty (rule has no SecretGroup), Match is used.
func RedactOpaque ¶
RedactOpaque scans content with the default scanner and replaces every detected secret with the literal token [REDACTED]. Use this for log files, training exports, CLI display, and other paths where the consumer is a human (or non-LLM tool) and self-disclosing metadata would either be noise or a leak of original-value shape information.
For tool output that an LLM agent will read, use Redact instead so the agent can distinguish display-layer redactions from on-disk content.
If the default scanner cannot be initialised, content is returned unchanged.
func RedactOpaqueJSON ¶ added in v0.22.5
RedactOpaqueJSON redacts a serialized JSON payload and guarantees the result is still valid JSON. It re-encodes the document and redacts each string VALUE in its decoded form, so a secret whose scan boundary would otherwise split a JSON escape (\", \\, \uXXXX) can never orphan the escape and corrupt the document — the failure mode RedactOpaque's byte-level replacement risks when a gitleaks capture group swallows an escape adjacent to the secret.
When no secret is found the input is returned byte-for-byte unchanged (the re-encoding is discarded), so a clean payload is never reformatted. When content is not valid JSON (or is empty) it falls back to RedactOpaque, preserving today's behaviour for non-JSON callers.
Intended for outbound LLM request bodies (the egress redaction backstop); RedactOpaque remains the choice for free text.
func RedactTagged ¶
RedactTagged scans content with the default scanner and replaces every detected secret with [REDACTED:<rule-id>]. Use this for log files and debugging contexts where it's useful to know the *kind* of secret that was present without exposing its value, length, or entropy.
If the default scanner cannot be initialised, content is returned unchanged.
Types ¶
type Match ¶
type Match struct {
RuleID string // gitleaks rule ID (e.g. "openai-api-key", "generic-api-key")
Match string // the broader matched substring (rule-defined; may include the var name)
Secret string // the extracted secret value (the part to actually redact)
StartLine int // 1-based line number of the match
StartCol int
EndLine int
EndCol int
Entropy float32 // Shannon entropy of the secret as computed by gitleaks
}
Match describes a single secret detected in input text.
Source Files