Struct SecurityScanner 

pub struct SecurityScanner { /* private fields */ }

Security scanner

Implementations

impl SecurityScanner

pub fn new() -> Self

Create a new security scanner with default patterns Uses pre-compiled static regex patterns for optimal performance

Pattern order matters: more specific patterns (Stripe, Slack, JWT) must come BEFORE generic patterns (API_KEY, SECRET_TOKEN) to ensure proper detection and redaction.

pub fn allowlist(&mut self, pattern: &str)

Add a pattern to allowlist

pub fn add_custom_pattern(&mut self, pattern: &str)

Add a custom regex pattern for secret detection

Custom patterns are matched as generic secrets with High severity. Invalid regex patterns are silently ignored.

Example

use infiniloom_engine::security::SecurityScanner;

let mut scanner = SecurityScanner::new();
scanner.add_custom_pattern(r"MY_SECRET_[A-Z0-9]{32}");

pub fn add_custom_patterns(&mut self, patterns: &[String])

Add multiple custom patterns at once

pub fn scan(&self, content: &str, file_path: &str) -> Vec<SecretFinding>

Scan content for secrets

pub fn is_safe(&self, content: &str, file_path: &str) -> bool

Scan a file and return whether it’s safe to include

pub fn summarize(findings: &[SecretFinding]) -> String

Get summary of findings

pub fn redact_content(&self, content: &str, _file_path: &str) -> String

Redact secrets from content, returning the redacted content This replaces detected secrets with redacted versions in the actual content

pub fn scan_and_redact( &self, content: &str, file_path: &str, ) -> (String, Vec<SecretFinding>)

Scan and redact all secrets from content.

Returns a tuple of (redacted_content, findings) where:

• redacted_content has all detected secrets replaced with [REDACTED]
• findings is a list of all detected secrets with metadata

Important

Always check the findings list to understand what was redacted and whether the file should be excluded from context entirely.

Trait Implementations

impl Default for SecurityScanner

fn default() -> Self

Returns the “default value” for a type.