Crate keyhog_core 

Core types shared across all KeyHog crates.

Defines the Source trait for pluggable input backends, DetectorSpec for TOML-based pattern definitions, [Finding] for scanner output, DedupedMatch for grouped findings, and [Report] for structured result formatting.

Re-exports

pub use allowlist::*;

pub use config::*;

pub use report::*;

Modules

allowlist

Credential/path allowlist parsing and matching. Allowlist support: .keyhogignore file parsing for suppressing known false positives by path glob, detector ID, or credential hash.

banner

config

Configuration system for KeyHog scanning options. Configuration for KeyHog scanning and verification.

registry

Global registry for pluggable components (Sources, Verifiers). This allows adding new features in a single file without modifying the core.

report

Reporting logic for scan results.

serde_arc_str

serde_arc_str_opt

Structs

Chunk

A scannable chunk of text with metadata about where it came from.

ChunkMetadata

Metadata that tracks the source location for a scanned chunk.

CompanionSpec

Secondary pattern used to confirm a primary match or provide extra context.

DedupedMatch

A group of related raw matches representing a single distinct secret finding.

DetectorFile

Wrapping struct for a detector TOML file.

DetectorSpec

A complete detector definition loaded from a TOML file.

HeaderSpec

Custom HTTP header specification.

MatchLocation

Where a credential was found: file path, line number, commit, and author.

MetadataSpec

Metadata field specification for verification results.

PatternSpec

A regex pattern with optional capture group and description.

RawMatch

A raw pattern match before verification or deduplication.

StepSpec

A single step in a multi-step verification flow.

SuccessSpec

Criteria for a successful verification response.

VerifiedFinding

A finding after verification — the final output.

VerifySpec

Live verification configuration for a detector.

Enums

AuthSpec

Authentication scheme for verification requests.

DedupScope

Deduplication scope for grouping findings.

HttpMethod

HTTP method for verification requests.

QualityIssue

Quality issue found in a detector spec.

Severity

Severity level for a finding.

SourceError

Errors returned by input sources while enumerating or reading content.

SpecError

Errors returned while loading or validating detector specifications.

VerificationResult

Result of live verification: whether the credential is active, revoked, or untested.

Traits

Source

Produces chunks of text for the scanner to process. Each implementation handles a different input source.

Functions

dedup_matches

Deduplicate raw matches according to the given DedupScope.

embedded_detector_tomls

Load detectors from embedded data (compiled into the binary). Returns detector TOML strings that can be parsed by the spec loader.

load_detector_cache

Load detectors from a JSON cache file. Returns None if cache is stale or missing.

load_detectors

Load all detector specs from a directory of TOML files. Runs quality gate on each detector. Rejects detectors with errors, warns on issues.

load_detectors_with_gate

Load detectors with optional quality gate enforcement. When enforce_gate is true, detectors with quality errors are skipped.

redact

Redact a sensitive credential string for safe display.

save_detector_cache

Save detectors to a JSON cache file for fast subsequent loads.

validate_detector

Validate a detector spec against the quality gate.