Module secrets 

Built-in secret patterns. Deliberately narrow: each one is a format with a fixed prefix or header, so a hit is almost always real. Two shapes need a second look: a connection string (scheme://user:password@host) is skipped when its host is an example or loopback host or its password is a placeholder, and a JWT is skipped when it is the well-known jwt.io sample.

Structs

Hit

One built-in secret in a text, by byte range.

SecretPattern

Constants

MARKER

How a redacted value starts; a body holding it was read through redaction.

Functions

all

attachment_scan

The attachments the secrets check reads, and the ones it skips because they are over max bytes or binary. Missing files are in neither list; E2 reports them.

find

Every built-in secret in text, in order, without the example and placeholder shapes above.

redact

text with each built-in secret replaced by [redacted: <name>], and how many were replaced.

scanned_attachments

A document’s repository attachments that the secrets check reads: bundle files and files entries kept in the repository, at most max bytes, and text (no NUL in the first 8 KiB). Stored files are not here; spec attach checks them before upload.

skipped_note

One line naming attachments the secrets check did not read, or None when it read them all. Only files over max bytes are told to raise [files] scan_max_bytes; binary files are never read.