pub struct SecretPatternSet { /* private fields */ }Expand description
A collection of secret-detection rules applied to tool output.
Construct with SecretPatternSet::default_common for the curated
set (Authorization headers, key-value tokens, AWS keys, PEM
private-key blocks, GitHub/GitLab PATs, and a high-entropy heuristic
for unknown formats), then extend with
SecretPatternSet::with_pattern for host-specific shapes. The set
is Send + Sync (each regex::Regex is), so it can live behind
an Arc in a shared pipeline.
Implementations§
Source§impl SecretPatternSet
impl SecretPatternSet
Sourcepub fn default_common() -> Self
pub fn default_common() -> Self
The curated default: shapes that recur across providers and hosts.
Covers Authorization: Bearer … headers, api_key=-style
key-value tokens, AWS access-key IDs, PEM private-key blocks,
and the GitHub (gh[pousr]_…) and GitLab (glpat-…) PAT
families. Each match becomes [REDACTED:<kind>]; the whole PEM
block collapses to one placeholder. The high-entropy heuristic is
on.
Sourcepub fn with_pattern(self, pattern: SecretPattern) -> Self
pub fn with_pattern(self, pattern: SecretPattern) -> Self
Add a host-supplied rule. Returns self for chaining.
The pattern arrives already compiled (the host owns the invalid-regex error), so this cannot fail.
Sourcepub fn with_entropy_heuristic(self, enabled: bool) -> Self
pub fn with_entropy_heuristic(self, enabled: bool) -> Self
Toggle the high-entropy heuristic. Returns self for chaining.
With the heuristic off, only the explicit patterns (curated plus host-added) scrub — zero false positives from novel-token detection, at the cost of missing formats no literal covers.
Sourcepub fn scrub(&self, text: &mut String) -> usize
pub fn scrub(&self, text: &mut String) -> usize
Rewrite text in place, replacing every secret match with its
[REDACTED:<kind>] placeholder.
Returns the count of redactions made, for observability (a
host can log it). Explicit patterns run first; when the entropy
heuristic is enabled, any remaining token of at least 32
characters whose byte entropy reaches 4.5 bits per byte becomes
[REDACTED:high_entropy].