Feature
Three verdicts, one gate
Every finding gets exactly one verdict: private, public or triage. Only private fails the gate.
private means the value has a real secret shape, or its name by convention holds a secret. It is a shape match, not proof of a live credential, and it fails the gate.
public means the value is safe by design: a publishable key, a public-prefixed name or a documented placeholder. Public findings are counted, not listed.
triage means no rule decided either way. Triage findings are listed for a human and do not fail the gate.
So CI reads one number: .summary.private. Above zero fails the job.
More features
All features →- 01
Value rules before name rules
Rules on the shape of the value run before rules on the variable name, so a public-looking name never hides a private value.
- 02
Counts-only output
Reports carry counts, paths, lines, rule names and fingerprints. A raw secret value is never printed.
- 03
Reviewed exceptions
Two kinds of hand-reviewed rule stop known-safe findings: whole-file exceptions and line-bound exceptions.