Feature
Three-way equivalence
A TS build and a Go build of the same tools are checked against the .mjs modules on the same inputs, byte for byte.
The live three-way equivalence test runs the .mjs modules, the TS build and the Go build on the same inputs and compares raw stdout bytes and exit codes: 109 hermetic git scenarios, 129 tests.
A seeded differential fuzz of classify runs across all three in CI.
Exactly three enumerated deviations are allowed: RE2 case folding in Go (which errs toward private), the default --out path of config gitleaks, and usage wording.
More features
All features →- 01
Three verdicts, one gate
Every finding gets exactly one verdict:
private,publicortriage. Onlyprivatefails the gate. - 02
Value rules before name rules
Rules on the shape of the value run before rules on the variable name, so a public-looking name never hides a private value.
- 03
Counts-only output
Reports carry counts, paths, lines, rule names and fingerprints. A raw secret value is never printed.