TigahandGitHub d93fcbcd46 fix(scan): tune js secret rules for false positives and missed formats (#344) ...

* fix(scan): tune js secret rules for false positives and missed formats

drop stripe pk_ publishable keys (public by design) and require a digit in
the generic secret value so camelCase identifiers stop tripping the entropy
gate. add stripe rk_ restricted keys, github fine-grained pat (github_pat_),
encrypted pem headers and version-anchored slack xapp tokens; drop the
trailing word boundary on the aws-secret and google rules so keys ending in
/ + or - still match.

renames the "stripe live key" rule to "stripe secret key", which changes
the rule label in the json findings output.

* feat(scan): detect more provider keys in javascript

add unique-prefix credential rules to the js secret bank: gitlab pat
(glpat-), anthropic api/admin keys (sk-ant-), npm tokens (npm_), google
oauth client secrets (GOCSPX-), stripe webhook secrets (whsec_), shopify
app tokens (shp[at|ss|pa|ca]_), sendgrid keys (SG.) and slack incoming
webhook urls. all ride the no-entropy slot since the prefix alone is
proof, so they carry near-zero false-positive risk.

2026-07-22 12:55:17 -07:00

..

frameworks

fix(store,logger,scan): concurrency-adjacent races and correctness fixes (#343)

2026-07-22 12:55:08 -07:00

endpoints_test.go

feat(js): extract secrets and endpoints from scanned javascript

2026-06-09 18:11:38 -07:00

endpoints.go

fix(js): supabase jwt base64url decode and per-project error isolation (#342)

2026-07-22 12:54:58 -07:00

probe2_test.go

fix(js): supabase jwt base64url decode and per-project error isolation (#342)

2026-07-22 12:54:58 -07:00

probe_test.go

fix(js): supabase jwt base64url decode and per-project error isolation (#342)

2026-07-22 12:54:58 -07:00

scan.go

fix(js): supabase jwt base64url decode and per-project error isolation (#342)

2026-07-22 12:54:58 -07:00

secrets_test.go

fix(scan): tune js secret rules for false positives and missed formats (#344)

2026-07-22 12:55:17 -07:00

secrets.go

fix(scan): tune js secret rules for false positives and missed formats (#344)

2026-07-22 12:55:17 -07:00

supabase_test.go

fix(js): supabase jwt base64url decode and per-project error isolation (#342)

2026-07-22 12:54:58 -07:00

supabase.go

fix(js): supabase jwt base64url decode and per-project error isolation (#342)

2026-07-22 12:54:58 -07:00