1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
// 🛡️ vaultgate.rs — Secrets Detection + Vault Gatekeeper
use std::fs;
use std::path::Path;
use std::collections::HashSet;
/// 🔐 Hardcoded sensitive patterns (upgradeable to load from vault_rules.toml)
const SENSITIVE_PATTERNS: &[&str] = &[
"api_key",
"secret",
"password",
"PRIVATE_KEY",
"-----BEGIN",
"auth_token",
"access_token",
"bearer ",
];
/// 🔍 Scans a file for sensitive content like secrets, tokens, or private keys
pub fn contains_sensitive_data(path: &Path) -> bool {
if let Ok(content) = fs::read_to_string(path) {
SENSITIVE_PATTERNS.iter().any(|pat| content.contains(pat))
} else {
false
}
}
/// 🛡️ Final VaultGate filter logic
/// Returns true if a file should be excluded from Vault creation
pub fn should_block_file(path: &Path, ignore_patterns: &[String]) -> bool {
// Convert ignore_patterns into HashSet once for shared use
let ignore_set: HashSet<String> = ignore_patterns.iter().cloned().collect();
// Skip if file doesn't meet Vault naming criteria
if !is_valid_vault(path.to_str().unwrap_or(""), &ignore_set) {
return true;
}
// Skip if explicitly ignored in .vaultignore
if is_ignored(path, &ignore_set) {
return true;
}
// Skip if secrets detected
if contains_sensitive_data(path) {
return true;
}
false
}