Skip to main content

looks_encrypted

sanitize_engine::secrets

Function looks_encrypted 

Source 
pub fn looks_encrypted(data: &[u8]) -> bool
Expand description

Detect whether raw file bytes look like an AES-256-GCM encrypted secrets blob (binary with salt+nonce header) or a plaintext secrets file (UTF-8 JSON / YAML / TOML).

Returns true if the content appears to be encrypted.

Heuristic:

  1. Files shorter than the minimum encrypted length cannot be valid ciphertext.
  2. If the content is valid UTF-8, starts with a JSON/YAML/TOML marker, and successfully parses as Vec<SecretEntry>, it is considered plaintext.
  3. Otherwise it is assumed to be encrypted.