Published module
patterns.mjs
The classifier and the reviewed exceptions. The other three modules import it; you can too.
classify({ name, value }) returns private, public or triage. name may be undefined, for example in a built artifact where no variable name survives; then only the value rules and the JWT check apply.
Value rules run first: the public value rules, then the private ones, then the JWT check on the role claim. Name rules run only after that, private before public. A value no rule decides is triage.
It also exports the rule tables (VALUE_PATTERNS, NAME_PATTERNS), the reviewed exceptions (ALLOWLIST_PATHS, ALLOWLIST_FINDINGS) and the helpers the gitleaks filter uses for line-bound exceptions.
More tools
All tools →- 01
generate-gitleaks-config.mjs
Writes the generated gitleaks config from the private value rules and the whole-file exceptions.
- 02
filter-gitleaks-output.mjs
Reads a gitleaks JSON report, applies the reviewed exceptions and prints a counts-only summary.
- 03
filter-trufflehog-output.mjs
Reads trufflehog NDJSON on stdin, applies the whole-file exceptions and prints a counts-only summary.