Feature
A path-based consumer contract
Consumers call the modules by file path from the installed package, so the paths, arguments and stdout JSON are the contract.
The path is scripts/secret-scan/<file>.mjs inside the installed package. The modules are zero-dependency ESM and run main() on load, so node <path> is all a workflow needs.
A dogfood job in this repository’s CI runs the exact consumer lines against the repository itself and fails on any private finding.
More features
All features →- 01
Three verdicts, one gate
Every finding gets exactly one verdict:
private,publicortriage. Onlyprivatefails the gate. - 02
Value rules before name rules
Rules on the shape of the value run before rules on the variable name, so a public-looking name never hides a private value.
- 03
Counts-only output
Reports carry counts, paths, lines, rule names and fingerprints. A raw secret value is never printed.