Documentation
¶
Overview ¶
Package detect finds GitHub credentials in arbitrary byte content.
It is built for throughput: a scan is a handful of SIMD-accelerated substring searches for the fixed token prefixes followed by an exact shape check and, for the classic token families, an offline CRC32 checksum verification. A well-formed string with a wrong checksum is not a token; that single check removes the false positives a regex scanner has to live with.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Checksum ¶
Checksum computes the 6-character Base62 CRC32 checksum GitHub appends to the 30 random characters of a classic token. Exported so callers (and tests) can construct well-formed tokens without hard-coding any.
func Fingerprint ¶
Fingerprint returns the fingerprint of a raw token value.
Types ¶
type Kind ¶
type Kind string
Kind names a GitHub credential family.
const ( // KindPAT is a classic personal access token (ghp_). KindPAT Kind = "github-pat" // KindOAuth is an OAuth app access token (gho_). KindOAuth Kind = "github-oauth" // KindUserToServer is a GitHub App user-to-server token (ghu_). KindUserToServer Kind = "github-user-to-server" // KindServerToServer is a GitHub App installation token (ghs_). KindServerToServer Kind = "github-server-to-server" // KindRefresh is a GitHub App refresh token (ghr_). KindRefresh Kind = "github-refresh" // KindFineGrained is a fine-grained personal access token (github_pat_). KindFineGrained Kind = "github-fine-grained-pat" )
type Token ¶
type Token struct {
Kind Kind
Value string
// Offset is the byte offset of the token in the scanned content.
Offset int
// Line is the 1-based line the token starts on.
Line int
// ChecksumVerified reports whether the token carries a CRC32 checksum
// that was verified offline. Classic tokens do; the fine-grained format
// is matched on shape alone.
ChecksumVerified bool
}
Token is one credential found in scanned content.
func Find ¶
Find returns every GitHub token in content, sorted by offset.
Two substring passes cover all six families: one for the shared "gh" stem of the classic prefixes and one for "github_pat_". Every candidate is then checked for exact shape and (classic families) checksum.
func (Token) Fingerprint ¶
Fingerprint returns a short, stable, non-reversible identifier for the token value: the first 16 hex characters of its SHA-256. It is safe to put in logs and allow-lists.
type Verification ¶
type Verification struct {
Status VerifyStatus `json:"status"`
Detail string `json:"detail,omitempty"`
}
Verification is the result of Verifier.Verify.
type Verifier ¶
type Verifier struct {
// BaseURL is the API root, https://api.github.com by default.
BaseURL string
Client *http.Client
}
Verifier checks whether a token is still accepted by GitHub. It never stores or logs the token value.
func NewVerifier ¶
func NewVerifier() *Verifier
NewVerifier returns a Verifier against the public GitHub API.
type VerifyStatus ¶
type VerifyStatus string
VerifyStatus is the outcome of checking a token against the GitHub API.
const ( // StatusActive means the API accepted the token: it is live and must be revoked. StatusActive VerifyStatus = "active" // StatusRevoked means the API rejected the token as bad credentials. StatusRevoked VerifyStatus = "revoked" // StatusUnverifiable means the token family cannot be checked against the API. StatusUnverifiable VerifyStatus = "unverifiable" // StatusUnknown means the check could not be completed (network, rate limit). StatusUnknown VerifyStatus = "unknown" )
Source Files