The product

Four zero-dependency ESM files for Node 24 or later: patterns.mjs (the classifier and the reviewed exceptions), generate-gitleaks-config.mjs, filter-gitleaks-output.mjs and filter-trufflehog-output.mjs.

Consumers call them by file path from the installed package, so the path scripts/secret-scan/<file>.mjs is the consumer contract.

classify() turns a name and a value into one verdict. Value rules, which match the shape of the value itself, run before name rules, which match a variable name. A public-looking name never hides a private value.

A JWT-shaped value is decided by the role claim in its payload. A value no rule decides is triage.

The gitleaks filter reads a gitleaks JSON report; the trufflehog filter reads trufflehog NDJSON on stdin. Both apply the reviewed exceptions, classify each value and print JSON with a summary and the private and triage lists.

A trufflehog-verified finding is always private, unless a whole-file exception dropped it first.

A whole-file exception (ALLOWLIST_PATHS) drops every finding in a file that holds secret-shaped text by design, such as tests, fixtures and docs.

A line-bound exception (ALLOWLIST_FINDINGS) suppresses one gitleaks finding only when its path matches and the line fingerprint of its source line matches a reviewed value. Edit the line and the finding is reported again.

The repository also holds a TS build (secret-scan-ts) and a Go build (secret-scan-go) of the same tools. They are not published. A live three-way equivalence test runs the .mjs files, the TS build and the Go build on the same inputs and compares raw stdout bytes and exit codes.

@catesworks/secret-scan is published only to GitHub Packages as a restricted package, and the source repository is private. Installing it needs a token with read access to the package; it is not on the public npm registry.