Documentation
¶
Overview ¶
Package credscan finds literal credentials sitting in a config file.
GTB ships a `credentials.no-literal` doctor check, but it scans a CLOSED list of GTB's own keys (anthropic, github, gitlab, …). None of keryx's platform tokens are on it, so that check reported "no literal credentials in config" while three live OAuth tokens sat in the file it had just read (spec 0042 Q4).
The lesson is the closed list, not the scope. Matching on the SHAPE of a key catches a platform keryx does not know about yet, a hand-edited key, and a key somebody added without remembering to register it — none of which a list can do. A false positive here costs a glance; a false all-clear is what happened.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var SecretLeaf = regexp.MustCompile(`(?i)(token|secret|password|webhook|smtp|credential|api_key|^(.*_)?code$)`)
SecretLeaf marks a final path segment as secret-bearing: tokens, client secrets, webhook URLs, SMTP passwords, credentials, and OAuth authorization codes.
`code` matches as the exact leaf or a `_code` suffix, so `category_code` is caught while `keyword` is not. It is on the list because a real `code:` leaf — an OAuth authorization code captured by the auth callback flow — has now been found in BOTH a project file and a user config, put there by a leaked flag.
This is the single source of truth: pkg/studio's masked YAML editor uses it too. It was previously duplicated and the two lists drifted in BOTH directions — the studio's knew about `code` and missed `api_key`; this one knew `api_key` and missed `code`. The copy that omitted `code` was the one `doctor` scans with, so doctor would have called a file clean while it held an OAuth code.
`api_key` is matched in full rather than as a `_key` suffix on purpose: `client_key` is TikTok's PUBLIC client identifier, and flagging it would train the reader to ignore the warning.
Functions ¶
func InYAML ¶
InYAML returns the credential paths carrying a non-empty value in a YAML document. Used for files that are not part of a loaded config Store — most importantly a project's committable .keryx.yaml.
func IsCredential ¶
IsCredential reports whether a dotted config path names a secret VALUE.
Matched on the LAST segment only, so `platforms.x.access_token` is a credential while `platforms.x.access_token.env` — which names an env var rather than holding one — is not.
Types ¶
This section is empty.
Source Files