FAQ
Frequently asked questions
Short answers to the questions people ask first.
Is there a hosted version or an account to sign up for?
No. secret-scan is a set of Node modules that run in your CI job or on your machine. There is no sign-in and no account.
Can I install it from npm?
Not from the public npm registry. @catesworks/secret-scan is a restricted package on GitHub Packages; installing it needs a token with read:packages on the package. Ask through the contact form if you need access.
Does secret-scan scan my code?
No. gitleaks and trufflehog scan. secret-scan generates the gitleaks config, then classifies the scanners’ output and prints a counts-only summary.
Does a private verdict mean the credential is live?
No. private is a shape match, not proof of a live credential. The exception is a trufflehog-verified finding, which trufflehog confirmed with the provider.
Why does triage not fail the build?
Triage means no rule decided either way. The findings are listed for a human, and the gate counts private findings only.
Will it print a secret into my CI log?
No. Output is counts-only: counts, paths, lines, rule names and fingerprints, never the matched value.
Why does the gitleaks filter need the repository as its cwd?
For a finding under a line-bound exception it re-reads the source line from git. Run it with the cwd at the scanned repository root and git on PATH; if it cannot read the line, it reports the finding.
Which implementation should I use, .mjs, TS or Go?
The .mjs modules: they are the published package and the consumer contract. The TS and Go builds live in the repository, are not published, and are checked against the .mjs files by the three-way equivalence test.
Still stuck? Contact us.