fix(scanner): fail on invalid input and anchor baselines to the repo - #111
Closed
pixincreate wants to merge 2 commits into
Closed
pixincreate wants to merge 2 commits into
pixincreate wants to merge 2 commits into
Conversation
pixincreate
force-pushed
the
fix/detector-formats
branch
from
September 14, 2026 16:14
65557b2 to
d640f26
Compare
pixincreate
force-pushed
the
fix/scanner-strictness
branch
from
September 14, 2026 16:14
bafc920 to
7c20d43
Compare
A scan that cannot read its input must not report a clean pass, and a baseline must suppress the same finding no matter which directory or scan mode produced it. Input strictness: - A scan operand that does not exist, is a symlink, or is not a regular file or directory is a hard error (exit 2) instead of a silent "No secrets found". An explicitly named directory that cannot be listed errors the same way; a nested unlistable directory is reported as unscannable so --fail-on-unscannable catches it. - The same file passed under two spellings (dup.txt ./dup.txt) scans once. The dedup key is lexically normalized without ever turning a relative path absolute, and backslash folding is Windows-only since a backslash is an ordinary unix filename character. - --fail-on-unscannable names the unscannable files in its summary instead of printing "No secrets found." next to exit code 1. History scans: - scan --git-history walks every ref (git log --all); a secret on a side branch was previously invisible. - A new --rev-range flag restricts the walk to a revision range. The value is rejected if it looks like a flag, since it lands on the git command line. - Failed git diff/log invocations report one summarized stderr line instead of dumping pages of git usage text; stderr is drained on its own thread so a large dump cannot deadlock the scan. Baselines: - Fingerprint paths anchor to the repository root, probed at the scan operand, so a baseline created in a subdirectory (or from outside the repository) suppresses the same finding in staged and history scans. Entries are stored root-relative going forward; baselines written at the repository root keep matching unchanged. Configuration and reporting: - Unknown keys in .keywatch.toml and detector files are rejected instead of silently ignored; CustomRule keeps accepting the inert description key for compatibility. - KeyWatch warns on stderr when a repository-supplied detectors.toml replaces the embedded set, when config overrides disable detectors, and when KEYWATCH_CONFIG_PATH is set but ignored. Operator channels (the env var, user config dir) stay quiet so the repository warning keeps meaning something. - Non-verbose scans print the location, type and redacted match of every finding instead of only a severity count. - SARIF output drops the blanket precision: very-high claim and omits semanticVersion when unknown. Assisted-by: Claude Fable 5 Signed-off-by: PiX <69745008+pixincreate@users.noreply.github.com>
The deny_unknown_fields comment used a deliberately misspelled config key as its example, which the typos CI job rejects. Use the [[custom_rules]] example alone. Assisted-by: Claude Fable 5 Signed-off-by: PiX <69745008+pixincreate@users.noreply.github.com>
pixincreate
force-pushed
the
fix/detector-formats
branch
from
September 14, 2026 16:19
d640f26 to
fb8d09e
Compare
pixincreate
force-pushed
the
fix/scanner-strictness
branch
from
September 14, 2026 16:19
03f8330 to
73acc0a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked PR 3 of 5 (base:
fix/detector-formats).Input strictness: a scan operand that does not exist, is a symlink, is not a regular file or directory, or is an unlistable directory now exits 2 instead of reporting a silent clean pass. Nested unlistable directories are reported as unscannable so
--fail-on-unscannablecatches them. The same file passed under two spellings scans once.History scans:
--git-historywalks every ref (git log --all), so side-branch secrets are found; a new--rev-rangeflag restricts the walk and rejects flag-shaped values. Failed git invocations report one summarized stderr line, drained on its own thread.Baselines: fingerprint paths anchor to the repository root, so a baseline created in a subdirectory (or from outside the repository) suppresses the same finding in staged and history scans.
Config and reporting: unknown config keys are rejected; stderr warnings when a repository-supplied
detectors.tomlreplaces the embedded set, when overrides disable detectors, or whenKEYWATCH_CONFIG_PATHis ignored; non-verbose scans print finding locations with redacted matches; SARIF drops the blanketprecision: very-highclaim.