Struct DetectorSpec 

pub struct DetectorSpec {
    pub id: String,
    pub name: String,
    pub service: String,
    pub severity: Severity,
    pub patterns: Vec<PatternSpec>,
    pub companions: Vec<CompanionSpec>,
    pub verify: Option<VerifySpec>,
    pub keywords: Vec<String>,
    pub min_confidence: Option<f64>,
    pub tests: Vec<DetectorTestSpec>,
}

A complete detector definition loaded from a TOML file.

Fields

id: String

Unique stable identifier (e.g. `aws-access-key`).

name: String

Human-readable name.

service: String

Target service (e.g. `aws`, `stripe`).

severity: Severity

Default severity for findings.

patterns: Vec<PatternSpec>

List of regex patterns to match.

companions: Vec<CompanionSpec>

Secondary patterns required to confirm a match.

verify: Option<VerifySpec>

Live verification configuration.

keywords: Vec<String>

High-performance pre-filtering keywords.

min_confidence: Option<f64>

Self-declared per-detector confidence floor, in [0.0, 1.0].

When set, findings from THIS detector use this floor instead of the global --min-confidence / [scan] min_confidence. A detector with a distinctive vendor prefix (e.g. sourcegraph sgp_<40hex>, cursor key_<64hex>) is high-confidence by virtue of the prefix even when the body is low-entropy hex that the generic confidence model scores below the global floor; the detector author declares that here so the detector ships working out of the box. Costs nothing at scan time — it is a single O(1) map lookup at the post-scan floor gate, on an already-compiled corpus. An operator .keyhog.toml [detector.<id>] min_confidence still overrides this self-declared default. None (the default) means “use the global floor”.

tests: Vec<DetectorTestSpec>

Inline self-test fixtures ([[detector.tests]], Tier-B data): each entry carries a positive example the detector MUST fire on and/or a negative example it MUST NOT. Consumed by the contract/self-validate harness; ignored at scan time. Modeled here (rather than silently dropped) so the schema’s deny_unknown_fields typo-guard covers the whole detector file.

Trait Implementations

impl Clone for DetectorSpec

fn clone(&self) -> DetectorSpec

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for DetectorSpec

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for DetectorSpec

fn default() -> DetectorSpec

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for DetectorSpec

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for DetectorSpec

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.