Secret-Scan Triage That Refuses to Bury

Triages secret-scanner findings by exploitability so the real leak is not buried under false positives.

THE SILENT FAILURE. Scanners fail in two directions and both are quiet. False positives bury real findings: a scanner reporting four hundred hits per run gets muted or made non-blocking, after which it catches nothing and nobody records that decision. False negatives are worse and entirely invisible, because the absence of a finding reads exactly like safety.

Scores findings on signals that actually bear on exploitability: a known provider format with a verifiable prefix or checksum (each cited to its published format), placement in a test fixture or example, obvious placeholders, entropy consistent with a real key, and committed history versus working tree. Classifies into act-now, review and likely-noise, and NEVER auto-dismisses -- a dismissed finding stays visible and countable, because silent suppression is how the real one gets lost. Entropy alone is never sufficient for a high-confidence verdict; it flags UUIDs, hashes and minified code.

A REAL BUG FOUND BEFORE RELEASE: a Twilio Auth Token is EXACTLY 32 lowercase hex characters -- the entire format, not an edge case -- which the digest pattern matched, asserting it was a hash and dropping a live credential below the fail-closed default into the band a human is told to skim past. A shape shared by a real credential and a benign digest is now reported as AMBIGUOUS rather than resolved in either direction, and a hash-shaped guess discounts rather than overrides.

It never calls a provider to validate a credential. No network access. It reports what it cannot know: whether a key is live, rotated, or was ever exposed.

VERIFIED: 141 tests. Every mutation was observed FAILING before the source was restored -- a test never seen to fail is a decoration. Independently reviewed by a verifier whose job was to find what is wrong, not to agree.

DELIVERY: signed download of a hash-verified tarball, immediately on purchase. Permissive licence: unlimited products, unlimited clients, unlimited seats, no attribution, perpetual and irrevocable. One restriction, do not republish the source as source.

This is an engineering tool, not legal, tax or accounting advice. It computes and reports; a human decides.

Interface

What you call, and what comes back. Types and signatures only — the implementation ships with the source.

  export function base62Encode(value: number): string;
  export function padLeft(s: string, length: number, padChar: string): string;
  export function crc32(input: string): number;
  export function shannonEntropyBitsPerChar(value: string): number;
  export function checkPath(filePath: string): PathCheck;
  export function checkPlaceholder(value: string): PlaceholderCheck;
  export function matchProviders(value: string): ProviderDefinition[];
  export function listKnownProviders(): ReadonlyArray< Pick<ProviderDefinition, "id" | "name" | "citation" | "publicByDesign"> >;
  export function scoreFinding( value: string, filePath: string, location: "working-tree" | "history", ): ScoringResult;
  export function verdictForScore(score: number): Verdict;
  export function checkStructuredNonSecret(value: string): StructuredCheck;
  export function triage(findings: readonly SecretFinding[]): TriageVerdict[];

  export type StructuredKind = "uuid" | "hex-digest" | null;
  export type FindingLocation = "working-tree" | "history";
  export type ChecksumStatus = "verified" | "failed" | "not-applicable";
  export type Verdict = "act-now" | "review" | "likely-noise";