secretscan

type Detector struct {
	// contains filtered or unexported fields
}

type Engine int

type Match struct {
	RuleID     string
	RuleName   string
	Source     string  // rule source; always "kingfisher"
	Confidence string  // "high" | "medium" | "low"
	Pattern    string  // the rule's normalized RE2 pattern that fired (for evidence)
	Secret     string  // the selected secret capture
	Start      int     // byte offset of the secret in the scanned input
	End        int     // exclusive end offset
	Entropy    float64 // computed Shannon entropy (bits/byte) of the secret
}

type Options struct {
	// IncludeInvisible enables rules marked visible:false in the catalog
	// (kingfisher's noisy/experimental set). Off by default.
	IncludeInvisible bool
	// MaxMatchesPerRule caps ACCEPTED matches per rule per body (<=0 → default).
	MaxMatchesPerRule int
	// Engine selects the regex backend (zero value = EngineRE2 / go-re2).
	Engine Engine
	// BodyCacheSize bounds the per-body result cache (keyed by body SHA-256).
	// A value >0 enables caching; 0 leaves the caller default (Default enables
	// it, New leaves it off); <0 disables it explicitly. Hashing a body is far
	// cheaper than scanning it, so repeated identical bodies (SPA shells, records
	// re-seen across scan passes) are served from cache. Safe: Detect is a pure
	// function of (rule set, body).
	BodyCacheSize int
	// UseRegexSet enables the experimental compiled-regex Set prefilter
	// (setprefilter.go): the body is scanned once by a sharded go-re2 Set to learn
	// which rule patterns can match at all, and only those rules' capture regexes
	// are run. Off by default — it layers on top of the keyword prefilter and its
	// benefit is workload-dependent, so it ships benchmarked and opt-in. If the
	// set fails to compile, detection falls back to the keyword prefilter alone.
	UseRegexSet bool
	// RegexSetShardSize is the number of patterns per Set shard when UseRegexSet is
	// on (<=0 → default). A large single set may exceed go-re2's program-size
	// limit, so patterns are compiled into shards.
	RegexSetShardSize int
}