Crate keyhog_verifier 

Live credential verification: confirms whether detected secrets are actually active by making HTTP requests to the service’s API endpoint as specified in each detector’s [detector.verify] configuration.

Modules

oob

Out-of-band (OOB) callback verification via an embedded interactsh client.

rate_limit

Per-service rate limiting for verification requests.

sigv4

ssrf

SSRF protection for live verification.

Structs

VerificationEngine

Live-verification engine with shared client, cache, and concurrency limits.

VerifyConfig

Runtime configuration for live verification.

Enums

DedupScope

Deduplication scope for grouping findings.

VerifyError

Errors returned while constructing or executing live verification.

Functions

dedup_matches

Deduplicate raw matches according to the given DedupScope.

proxy_is_active

Returns true iff an explicit proxy is configured (and not a disable sentinel). No environment variable is consulted, neither the old keyhog proxy env var nor reqwest’s ambient proxy-env vars, because those are neutralized via .no_proxy() and can never route verifier traffic. This is the signal resolved_client_for_url() uses to decide whether to apply DNS pinning: with no proxy active it pins (SSRF / DNS-rebinding protection on the direct connection); with an explicit proxy the proxy resolves DNS, so pinning is skipped. Because an ambient proxy is now impossible, the old hazard of a pinned rebuild silently dropping an env-proxy (and connecting direct, past the operator’s interception) cannot occur.