Feature
Counts-only output
Reports carry counts, paths, lines, rule names and fingerprints. A raw secret value is never printed.
A fingerprint is the first 16 hex characters of the sha256 of the matched value. It identifies a finding across runs without revealing it.
The filtered report is safe to keep as a CI artifact or paste into a review: it names where to look, not what was found.
More features
All features →- 01
Three verdicts, one gate
Every finding gets exactly one verdict:
private,publicortriage. Onlyprivatefails the gate. - 02
Value rules before name rules
Rules on the shape of the value run before rules on the variable name, so a public-looking name never hides a private value.
- 03
Reviewed exceptions
Two kinds of hand-reviewed rule stop known-safe findings: whole-file exceptions and line-bound exceptions.