keyhog 0.5.44

keyhog detects leaked credentials in source trees, git history, archives, and remote sources
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213

use std::path::PathBuf;

/// On-disk `.keyhog.toml` root. Each setting has one table/key owner, and CLI
/// flags override the corresponding file value.
#[derive(Debug, Default, serde::Deserialize)]
#[serde(default, deny_unknown_fields)]
pub(super) struct ConfigFile {
    /// Path to detector TOMLs directory.
    pub detectors: Option<String>,
    /// Enable fast mode (no entropy discovery, ML scoring, or decode recursion).
    pub fast: Option<bool>,
    /// Enable the bounded deep-recovery preset.
    pub deep: Option<bool>,
    /// Enable high-precision mass-scan mode.
    pub precision: Option<bool>,
    /// Skip decode-through scanning.
    pub no_decode: Option<bool>,
    /// Skip entropy-based detection.
    pub no_entropy: Option<bool>,
    /// Whether to verify discovered credentials.
    pub verify: Option<bool>,
    /// Verification timeout in seconds.
    pub timeout: Option<u64>,
    /// Maximum concurrent verification requests per service.
    pub verify_concurrency: Option<usize>,
    /// Maximum git commits to traverse.
    pub max_commits: Option<usize>,
    /// Show full credentials (not redacted).
    pub show_secrets: Option<bool>,
    /// Maximum file size for decode-through scanning.
    pub decode_size_limit: Option<String>,
    /// Enable entropy scanning in source code files.
    pub entropy_source_files: Option<bool>,
    /// Admit credential-keyword-anchored generic values on a relaxed entropy floor.
    pub generic_keyword_low_entropy: Option<bool>,
    /// Disable Unicode normalization.
    pub no_unicode_norm: Option<bool>,
    /// Disable ML-based confidence scoring.
    pub no_ml: Option<bool>,
    /// Maximum file size to scan.
    pub max_file_size: Option<String>,
    /// Per-regex lazy-DFA cache ceiling.
    pub regex_dfa_limit: Option<String>,
    /// ML weight for confidence scoring, 0.0-1.0.
    pub ml_weight: Option<f64>,
    /// Known secret prefixes used to boost confidence.
    pub known_prefixes: Option<Vec<String>>,
    /// Keywords indicating a secret context.
    pub secret_keywords: Option<Vec<String>>,
    /// Keywords indicating a test/mock context.
    pub test_keywords: Option<Vec<String>>,
    /// Keywords indicating a placeholder value.
    pub placeholder_keywords: Option<Vec<String>>,
    /// `[scan]` - canonical runtime scan policy.
    pub scan: Option<ScanSection>,
    /// `[allowlist]` - `.keyhogignore` discovery + governance metadata.
    pub allowlist: Option<AllowlistSection>,
    /// `[detector.<id>]` - per-detector overrides keyed by detector_id.
    pub detector: Option<std::collections::HashMap<String, DetectorSection>>,
    /// `[lockdown]` - refuse to start unless explicit `--lockdown` flag.
    pub lockdown: Option<LockdownSection>,
    /// `[limits]` - source byte/count ceilings.
    pub limits: Option<LimitsSection>,
    /// `[http]` - explicit outbound HTTP proxy/TLS policy.
    pub http: Option<HttpSection>,
    /// `[system]` - host integration paths and other non-scan behavior.
    pub system: Option<SystemSection>,
    /// `[aws]` - AWS-specific offline safety metadata.
    pub aws: Option<AwsSection>,
    /// `[tuning]` - recall-equivalent scanner route tuning.
    pub tuning: Option<TuningSection>,
}

/// Canonical `[scan]` table. Scan-policy keys have one on-disk owner here.
#[derive(Debug, Default, serde::Deserialize)]
#[serde(default, deny_unknown_fields)]
pub(super) struct ScanSection {
    pub severity: Option<String>,
    pub min_confidence: Option<f64>,
    pub ml_threshold: Option<f64>,
    /// Shannon entropy threshold in bits per byte.
    pub entropy_threshold: Option<f64>,
    /// BPE word-likeness ceiling.
    pub entropy_bpe_max_bytes_per_token: Option<f64>,
    pub decode_depth: Option<usize>,
    pub min_secret_len: Option<usize>,
    pub format: Option<String>,
    pub exclude: Option<Vec<String>>,
    pub threads: Option<usize>,
    pub reader_threads: Option<usize>,
    pub fused_batch: Option<usize>,
    pub fused_depth: Option<usize>,
    pub per_chunk_timeout_ms: Option<u64>,
    pub dedup: Option<String>,
    pub incremental: Option<bool>,
    pub incremental_cache: Option<PathBuf>,
    /// GPU region-presence batch byte budget.
    pub gpu_batch_input_limit: Option<String>,
}

/// `[allowlist]` nested table.
#[derive(Debug, Default, serde::Deserialize)]
#[serde(default, deny_unknown_fields)]
pub(super) struct AllowlistSection {
    pub file: Option<String>,
    pub require_reason: Option<bool>,
    pub require_approved_by: Option<bool>,
    pub max_expires_days: Option<u64>,
}

/// `[detector.<id>]` per-detector override.
#[derive(Debug, Default, serde::Deserialize)]
#[serde(default, deny_unknown_fields)]
pub(super) struct DetectorSection {
    pub enabled: Option<bool>,
    pub min_confidence: Option<f64>,
}

/// `[lockdown]` enforcement.
#[derive(Debug, Default, serde::Deserialize)]
#[serde(default, deny_unknown_fields)]
pub(super) struct LockdownSection {
    pub require: Option<bool>,
}

/// `[limits]` source byte/count ceilings.
#[derive(Debug, Default, serde::Deserialize)]
#[serde(default, deny_unknown_fields)]
pub(super) struct LimitsSection {
    pub stdin_bytes: Option<String>,
    pub web_response_bytes: Option<String>,
    pub s3_object_bytes: Option<String>,
    pub gcs_object_bytes: Option<String>,
    pub azure_blob_bytes: Option<String>,
    pub cloud_max_objects: Option<usize>,
    pub docker_tar_entry_bytes: Option<String>,
    pub docker_image_config_bytes: Option<String>,
    pub docker_tar_total_bytes: Option<String>,
    pub git_line_bytes: Option<String>,
    pub git_total_bytes: Option<String>,
    pub git_blob_bytes: Option<String>,
    pub git_chunks: Option<usize>,
    pub hosted_git_pages: Option<usize>,
    pub binary_read_bytes: Option<String>,
    pub binary_decompiled_bytes: Option<String>,
}

/// `[http]` explicit outbound HTTP policy.
#[derive(Debug, Default, serde::Deserialize)]
#[serde(default, deny_unknown_fields)]
pub(super) struct HttpSection {
    /// Proxy URL or `off`.
    pub proxy: Option<String>,
    /// Disable TLS certificate verification for outbound HTTP.
    pub insecure_tls: Option<bool>,
    /// Allow cloud endpoints (`--s3-endpoint`, GCS / Azure container URLs) whose
    /// host resolves private / loopback / link-local / cloud-metadata. Off by
    /// default (the SSRF screen refuses them); the `--allow-private-cloud-endpoint`
    /// CLI flag overrides. For trusted private-network deployments only.
    pub allow_private_endpoint: Option<bool>,
}

/// `[system]` host integration settings.
#[derive(Debug, Default, serde::Deserialize)]
#[serde(default, deny_unknown_fields)]
pub(super) struct SystemSection {
    /// Absolute directories allowed by `keyhog_core::safe_bin` in addition to
    /// the compiled system defaults.
    pub trusted_bin_dirs: Option<Vec<PathBuf>>,
    /// Absolute Hyperscan compiled-database cache directory.
    pub cache_dir: Option<PathBuf>,
    /// Absolute autoroute calibration cache file, or `off` to disable.
    pub autoroute_cache: Option<String>,
    /// Absolute per-detector Bayesian calibration cache file for scan scoring.
    pub calibration_cache: Option<PathBuf>,
    /// Force the coalesced batch scan pipeline.
    pub batch_pipeline: Option<bool>,
    /// GPU runtime policy: auto, off, or required.
    pub gpu: Option<String>,
    /// Allow autoroute calibration to include GPU candidates.
    pub autoroute_gpu: Option<bool>,
}

/// `[aws]` offline AWS safety metadata.
#[derive(Debug, Default, serde::Deserialize)]
#[serde(default, deny_unknown_fields)]
pub(super) struct AwsSection {
    /// Extra 12-digit AWS account IDs treated as canary-token issuers.
    pub canary_accounts: Option<Vec<String>>,
    /// Extra 12-digit AWS account IDs treated as off-brand canary issuers.
    pub knockoff_accounts: Option<Vec<String>>,
}

/// `[tuning]` scanner performance-route overrides.
#[derive(Debug, Default, serde::Deserialize)]
#[serde(default, deny_unknown_fields)]
pub(super) struct TuningSection {
    pub fallback_hs: Option<bool>,
    pub hs_prefilter_max_len: Option<usize>,
    pub hs_shard_target: Option<usize>,
    pub fallback_anchor: Option<bool>,
    pub homoglyph_gate: Option<bool>,
    pub homoglyph_ascii_skip: Option<bool>,
    pub fallback_reverse: Option<bool>,
    pub prefilter_truncate: Option<bool>,
    pub fallback_prefix_gate: Option<bool>,
    pub decode_focus: Option<bool>,
    pub confirmed_suffix_gate: Option<bool>,
    pub no_candidate_gate: Option<bool>,
    pub fallback_localizer: Option<bool>,
    pub gpu_recall_floor: Option<bool>,
    pub gpu_moe_timeout_ms: Option<u64>,
}