Features
Features
Everything secret-scan does, one page per feature.
- 01
Three verdicts, one gate
Every finding gets exactly one verdict:
private,publicortriage. Onlyprivatefails the gate. - 02
Value rules before name rules
Rules on the shape of the value run before rules on the variable name, so a public-looking name never hides a private value.
- 03
Counts-only output
Reports carry counts, paths, lines, rule names and fingerprints. A raw secret value is never printed.
- 04
Reviewed exceptions
Two kinds of hand-reviewed rule stop known-safe findings: whole-file exceptions and line-bound exceptions.
- 05
Fail toward reporting
Any doubt in the suppression path reports the finding instead of suppressing it.
- 06
Trufflehog-verified is always private
When trufflehog confirmed a credential with its provider, the finding is
privatewhatever the classifier says. - 07
Three-way equivalence
A TS build and a Go build of the same tools are checked against the
.mjsmodules on the same inputs, byte for byte. - 08
A path-based consumer contract
Consumers call the modules by file path from the installed package, so the paths, arguments and stdout JSON are the contract.
Put one clear gate behind your scanner
Four zero-dependency Node modules that run in your CI job. Nothing calls a service and there is no account.