Module decode 

Decode-through pipeline for nested encodings (base64, hex, URL, etc.). Decode-through scanning: decode encoded strings before pattern matching.

Catches secrets hidden behind encoding layers - Kubernetes manifests, CI/CD configs, URL-escaped payloads, string escapes, and hex-encoded credentials.

Structs

DecodeAdmissionSketch

Bounded, content-free projection of decoder work.

DecodeWorkloadPlan

Effective immutable decode policy captured from one compiled scanner.

EncodedString

Candidate encoded string discovered during pre-decoding extraction.

Enums

DecodeAdmission

Proof carried from decoder-owned grammars to the scan admission path.

DecoderRegistrationError

Traits

Decoder

A trait for decoding chunks to find hidden secrets.

Functions

base64_decode

Decode a standard or URL-safe base64 string, bounded to MAX_BASE64_INPUT_LEN bytes for DoS safety. Err(()) on invalid or over-length input.

decode_admission_sketch

Compute a standalone decode work sketch with the bundled compatibility prefix policy. Autoroute uses crate::CompiledScanner::decode_workload_plan so its sketch matches the active detector corpus.

find_base64_strings

Find every base64/base64url substring of at least min_length bytes in text, returned as decodable EncodedString spans.

find_hex_strings

Find every hex substring of at least min_length bytes in text, returned as decodable EncodedString spans.

hex_decode

Decode a hex string (optionally _-separated), bounded to MAX_HEX_INPUT_LEN bytes for DoS safety. Err(()) on odd length or non-hex input.

is_base64_candidate_byte

Whether a byte can appear in a standard or URL-safe base64 string: ASCII alphanumeric or one of + / = - _.

register_decoder

Register a custom decoder for scanners compiled afterward.

try_register_decoder

Register a custom decoder and return descriptor or collision errors.

z85_decode

Decode a Z85-encoded string (length must be a multiple of 5), bounded to MAX_Z85_INPUT_LEN bytes for DoS safety. Err(()) on invalid input.