From c6509ad899b1f56a7c3191c37528114f8453478c Mon Sep 17 00:00:00 2001 From: Gill Samia Date: Sun, 9 Aug 2026 14:35:48 +0300 Subject: [PATCH 01/11] perf: add plan cache to eliminate repeated inspect calls in DI hot path The call_function_with_arguments() function is called O(lines x plugins) times during scanning. Previously, make_function_self_aware() ran on every call because bound methods are new objects on each attribute access. This change adds a _plan_cache dict keyed by id(func.__func__) for bound methods (stable across calls). The injectable parameter set is computed once per distinct callable and reused on subsequent calls. Feature flag: DETECT_SECRETS_PERF_DI_CACHE=0 disables the cache for debugging. --- detect_secrets/util/inject.py | 77 +++++++++++++++++- tests/perf/test_inject_cache.py | 139 ++++++++++++++++++++++++++++++++ 2 files changed, 212 insertions(+), 4 deletions(-) create mode 100644 tests/perf/test_inject_cache.py diff --git a/detect_secrets/util/inject.py b/detect_secrets/util/inject.py index 3e16b708c..2447e63e0 100644 --- a/detect_secrets/util/inject.py +++ b/detect_secrets/util/inject.py @@ -1,29 +1,98 @@ import inspect +import os from typing import Any from typing import Callable from typing import cast +from typing import Dict +from typing import Set from typing import Tuple from typing import Union from ..custom_types import SelfAwareCallable +# NOTE: id() returns the memory address in CPython, which can be reused after GC. +# This is safe here because plugin instances are long-lived (created once per scan +# and held in the settings registry). id() reuse is not a concern in practice. +_plan_cache: Dict[int, Tuple[Set[str], bool]] = {} + +# Feature flag: set DETECT_SECRETS_PERF_DI_CACHE=0 to disable and use the original slow path. +# Default: enabled (True). +_DI_CACHE_ENABLED: bool = os.getenv('DETECT_SECRETS_PERF_DI_CACHE', '1') != '0' + + def call_function_with_arguments( func: Union[Callable, SelfAwareCallable], **kwargs: Any, ) -> Any: """ + Calls func with only the keyword arguments it actually accepts. + + Uses a plan cache to avoid repeated inspect calls in the hot path. + The cache is keyed by id(func.__func__) for bound methods (stable across + calls) or id(func) for plain functions. + + NOTE: Interaction between cached and uncached paths: + When _DI_CACHE_ENABLED=False, the original make_function_self_aware() path runs. + That path mutates the class-level function object by setting injectable_variables. + When the cache is re-enabled, the cache is empty and will be rebuilt correctly. + The two paths are independent. + :raises: TypeError """ + if _DI_CACHE_ENABLED: + return _call_with_cache(func, **kwargs) + else: + return _call_without_cache(func, **kwargs) + + +def _call_with_cache(func: Union[Callable, SelfAwareCallable], **kwargs: Any) -> Any: + """Fast path: use cached plan to avoid repeated inspect calls.""" + is_bound = inspect.ismethod(func) + + # Use the underlying function's id for bound methods — stable across calls + # (Python creates a new bound method object on each attribute access, but + # func.__func__ is the stable underlying function object) + cache_key = id(func.__func__) if is_bound else id(func) + + plan = _plan_cache.get(cache_key) + if plan is None: + plan = _build_plan(func, is_bound) + _plan_cache[cache_key] = plan + + injectable, _ = plan + + # For bound methods, self is carried by the method itself — no need to inject it + filtered = {k: kwargs[k] for k in injectable if k in kwargs} + return func(**filtered) + + +def _build_plan(func: Union[Callable, SelfAwareCallable], is_bound: bool) -> Tuple[Set[str], bool]: + """ + Build the injection plan for a callable. + Returns (injectable_vars, is_bound). + + For bound methods, we use func.__func__ to get stable parameter names, + then drop index 0 ('self') because bound methods already carry the instance. + """ + if is_bound: + # Use the underlying unbound function to get all parameter names + all_vars = get_injectable_variables(func.__func__) + # Drop 'self' (index 0) — bound methods carry self implicitly + injectable = set(all_vars[1:]) + else: + injectable = set(get_injectable_variables(func)) + + return injectable, is_bound + + +def _call_without_cache(func: Union[Callable, SelfAwareCallable], **kwargs: Any) -> Any: + """Slow path (original implementation): used when _DI_CACHE_ENABLED=False.""" # First, we ensure that the function we're going to inject values into is self-aware. function = func if isinstance(func, SelfAwareCallable) else make_function_self_aware(func) # If `function` is derived from a method, we add the instance of the class by default. - # However, if `function` is a method itself, it will already carry the reference of the - # instance, so we don't need to explicitly include it. if inspect.ismethod(func) and not inspect.ismethod(function): - # We also use get_injectable_variables (instead of hardcoding "self") to make sure that - # this also handles cases where the developer doesn't name the first parameter `self`. kwargs[get_injectable_variables(func)[0]] = func.__self__ variables_to_inject = set(kwargs.keys()) diff --git a/tests/perf/test_inject_cache.py b/tests/perf/test_inject_cache.py new file mode 100644 index 000000000..e6ca0ff78 --- /dev/null +++ b/tests/perf/test_inject_cache.py @@ -0,0 +1,139 @@ +""" +Tests for the DI plan cache optimization in inject.py. + +The cache eliminates repeated inspect calls in the hot path by caching +the parameter plan for each callable after the first call. +""" +from __future__ import annotations + +from unittest.mock import patch + +import pytest + +from detect_secrets.util.inject import call_function_with_arguments +import detect_secrets.util.inject as inject_module + + +class _FakePlugin: + def analyze_line(self, filename: str, line: str, line_number: int = 0) -> list: + return [] + + def other_method(self, line: str) -> list: + return [] + + +def test_di_cache_reduces_make_function_self_aware_calls(): + """ + After the first call, make_function_self_aware should NOT be called again + for the same bound method (same underlying function). + """ + plugin = _FakePlugin() + + with patch.object(inject_module, 'make_function_self_aware', wraps=inject_module.make_function_self_aware) as mock_msfa: + # Call 1: should call make_function_self_aware + call_function_with_arguments( + plugin.analyze_line, + filename='test.py', + line='hello world', + line_number=1, + ) + # Call 2: same method, should NOT call make_function_self_aware again + call_function_with_arguments( + plugin.analyze_line, + filename='test.py', + line='another line', + line_number=2, + ) + # Call 3: same method again + call_function_with_arguments( + plugin.analyze_line, + filename='test.py', + line='third line', + line_number=3, + ) + + # With caching: make_function_self_aware called only once (or zero times if we bypass it entirely) + # Without caching: called 3 times + assert mock_msfa.call_count <= 1, ( + f'make_function_self_aware called {mock_msfa.call_count} times — ' + f'expected ≤1 (cache should prevent repeated calls)' + ) + + +def test_di_cache_separate_entries_for_different_methods(): + """Different methods get separate cache entries.""" + plugin = _FakePlugin() + + with patch.object(inject_module, 'make_function_self_aware', wraps=inject_module.make_function_self_aware) as mock_msfa: + call_function_with_arguments(plugin.analyze_line, filename='f.py', line='x', line_number=1) + call_function_with_arguments(plugin.other_method, line='x') + # Second calls — should use cache + call_function_with_arguments(plugin.analyze_line, filename='f.py', line='y', line_number=2) + call_function_with_arguments(plugin.other_method, line='y') + + # Each distinct method called once for make_function_self_aware (or zero if bypassed) + assert mock_msfa.call_count <= 2, ( + f'Expected ≤2 make_function_self_aware calls (one per distinct method), got {mock_msfa.call_count}' + ) + + +def test_di_cache_correct_results(): + """Cached calls return the same results as uncached calls.""" + plugin = _FakePlugin() + + result1 = call_function_with_arguments( + plugin.analyze_line, + filename='test.py', + line='hello', + line_number=1, + ) + result2 = call_function_with_arguments( + plugin.analyze_line, + filename='test.py', + line='hello', + line_number=1, + ) + assert result1 == result2 == [] + + +def test_di_cache_self_not_in_injectable(): + """'self' must NOT be in the cached injectable variables for bound methods.""" + plugin = _FakePlugin() + + # Clear cache to force a fresh computation + if hasattr(inject_module, '_plan_cache'): + inject_module._plan_cache.clear() + + call_function_with_arguments( + plugin.analyze_line, + filename='test.py', + line='hello', + line_number=1, + ) + + if hasattr(inject_module, '_plan_cache'): + cache_key = id(plugin.analyze_line.__func__) + if cache_key in inject_module._plan_cache: + plan = inject_module._plan_cache[cache_key] + injectable = plan[0] # first element is the injectable set + assert 'self' not in injectable, ( + f"'self' found in injectable variables: {injectable}. " + "Bound methods carry self implicitly — it must not be injected." + ) + + +def test_di_cache_disabled_by_flag(): + """When _DI_CACHE_ENABLED is False, the slow path runs (make_function_self_aware called each time).""" + plugin = _FakePlugin() + + if not hasattr(inject_module, '_DI_CACHE_ENABLED'): + pytest.skip('_DI_CACHE_ENABLED flag not implemented yet') + + with patch.object(inject_module, '_DI_CACHE_ENABLED', False): + with patch.object(inject_module, 'make_function_self_aware', wraps=inject_module.make_function_self_aware) as mock_msfa: + call_function_with_arguments(plugin.analyze_line, filename='f.py', line='x', line_number=1) + call_function_with_arguments(plugin.analyze_line, filename='f.py', line='y', line_number=2) + + assert mock_msfa.call_count >= 2, ( + f'Expected ≥2 calls when cache disabled, got {mock_msfa.call_count}' + ) From 3168e335e9995273ed61d212fcc66d21f6fa577a Mon Sep 17 00:00:00 2001 From: Gill Samia Date: Mon, 10 Aug 2026 13:12:30 +0300 Subject: [PATCH 02/11] fix: pin filter config to restore correct 343-finding parity baseline The golden snapshot was silently regenerated from 343 to 306 findings when the optional gibberish-detector package's ML filter auto-activated after dev dependencies finished installing mid-session, masking 37 real findings. Fix: explicitly disable this filter in all scan invocations via --disable-filter. Added test_parity_oracle_filter_config_is_pinned regression guard. Fixed a bug in the golden_findings fixture that read the wrong JSON keys (filename/line_number instead of file/line) for the flat snapshot format. Re-validated Task 3's DI cache: 343 findings both enabled and disabled. --- baselines/parity_snapshot.json | 1717 ++++++++++ baselines/perf-benchmark-baseline.json | 13 + baselines/secrets-examples-baseline.json | 3650 ++++++++++++++++++++++ baselines/timing-baseline.txt | 44 + scripts/perf_benchmark.py | 174 ++ tests/perf/test_parity_oracle.py | 175 ++ 6 files changed, 5773 insertions(+) create mode 100644 baselines/parity_snapshot.json create mode 100644 baselines/perf-benchmark-baseline.json create mode 100644 baselines/secrets-examples-baseline.json create mode 100644 baselines/timing-baseline.txt create mode 100644 scripts/perf_benchmark.py create mode 100644 tests/perf/test_parity_oracle.py diff --git a/baselines/parity_snapshot.json b/baselines/parity_snapshot.json new file mode 100644 index 000000000..14fa8e954 --- /dev/null +++ b/baselines/parity_snapshot.json @@ -0,0 +1,1717 @@ +[ + { + "file": "secrets-examples/.git/config", + "line": 9, + "type": "GitHub Token" + }, + { + "file": "secrets-examples/CKV_SECRET_101.txt", + "line": 3, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_102_1.txt", + "line": 3, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_102_2.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_103.txt", + "line": 2, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_104_1.txt", + "line": 4, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_105.txt", + "line": 2, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_106.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_107.txt", + "line": 2, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_108.txt", + "line": 2, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_109.txt", + "line": 2, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_110.txt", + "line": 2, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_112.txt", + "line": 2, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_113.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_113.txt", + "line": 3, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_114.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_114.txt", + "line": 3, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_115.txt", + "line": 2, + "type": "Azure Storage Account access key" + }, + { + "file": "secrets-examples/CKV_SECRET_115.txt", + "line": 2, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_117.txt", + "line": 4, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_118_2.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_118_2.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_118_2.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_12.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_12.txt", + "line": 1, + "type": "NPM tokens" + }, + { + "file": "secrets-examples/CKV_SECRET_121.txt", + "line": 2, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_122.txt", + "line": 3, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_124.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_125_2.txt", + "line": 2, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_125_2.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_125_2.txt", + "line": 3, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_125_2.txt", + "line": 3, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_126_1.txt", + "line": 2, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_126_2.txt", + "line": 2, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_126_2.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_126_2.txt", + "line": 3, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_126_2.txt", + "line": 3, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_127.txt", + "line": 2, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_127.txt", + "line": 3, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_127.txt", + "line": 4, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_127.txt", + "line": 6, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_128.txt", + "line": 2, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_128.txt", + "line": 3, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_132.txt", + "line": 2, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_133.txt", + "line": 2, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_134.txt", + "line": 2, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_135.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_136.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_137_1.txt", + "line": 2, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_137_1.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_137_2.txt", + "line": 2, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_139.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_142.txt", + "line": 2, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_142.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_143_1.txt", + "line": 2, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_143_1.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_143_2.txt", + "line": 3, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_143_2.txt", + "line": 3, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_144.txt", + "line": 4, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_145.txt", + "line": 4, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_145.txt", + "line": 4, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_145.txt", + "line": 8, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_146.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_147.txt", + "line": 3, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_147.txt", + "line": 3, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_147.txt", + "line": 7, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_147.txt", + "line": 7, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_149.txt", + "line": 2, + "type": "Basic Auth Credentials" + }, + { + "file": "secrets-examples/CKV_SECRET_149.txt", + "line": 4, + "type": "Basic Auth Credentials" + }, + { + "file": "secrets-examples/CKV_SECRET_149.txt", + "line": 13, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_150.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_151.txt", + "line": 8, + "type": "Basic Auth Credentials" + }, + { + "file": "secrets-examples/CKV_SECRET_152.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_153.txt", + "line": 3, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_155.txt", + "line": 2, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_157_2.txt", + "line": 3, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_157_3.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_158.txt", + "line": 5, + "type": "Basic Auth Credentials" + }, + { + "file": "secrets-examples/CKV_SECRET_159.txt", + "line": 5, + "type": "Basic Auth Credentials" + }, + { + "file": "secrets-examples/CKV_SECRET_162.txt", + "line": 1, + "type": "Basic Auth Credentials" + }, + { + "file": "secrets-examples/CKV_SECRET_162.txt", + "line": 2, + "type": "Basic Auth Credentials" + }, + { + "file": "secrets-examples/CKV_SECRET_163.txt", + "line": 1, + "type": "Basic Auth Credentials" + }, + { + "file": "secrets-examples/CKV_SECRET_163.txt", + "line": 2, + "type": "Basic Auth Credentials" + }, + { + "file": "secrets-examples/CKV_SECRET_164.txt", + "line": 1, + "type": "Basic Auth Credentials" + }, + { + "file": "secrets-examples/CKV_SECRET_164.txt", + "line": 3, + "type": "Basic Auth Credentials" + }, + { + "file": "secrets-examples/CKV_SECRET_165.txt", + "line": 1, + "type": "Basic Auth Credentials" + }, + { + "file": "secrets-examples/CKV_SECRET_165.txt", + "line": 3, + "type": "Basic Auth Credentials" + }, + { + "file": "secrets-examples/CKV_SECRET_166.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_167.txt", + "line": 3, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_167.txt", + "line": 3, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_167.txt", + "line": 5, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_167.txt", + "line": 7, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_168.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_168.txt", + "line": 3, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_169.txt", + "line": 2, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_169.txt", + "line": 3, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_170.txt", + "line": 2, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_170.txt", + "line": 3, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_172.txt", + "line": 2, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_173.txt", + "line": 7, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_173.txt", + "line": 10, + "type": "Private Key" + }, + { + "file": "secrets-examples/CKV_SECRET_176.txt", + "line": 3, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_176.txt", + "line": 4, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_176.txt", + "line": 4, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_177.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_178_1.txt", + "line": 3, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_178_1.txt", + "line": 8, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_178_1.txt", + "line": 11, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_180.txt", + "line": 2, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_180.txt", + "line": 3, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_182.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_183.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_185.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_191.txt", + "line": 2, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_194.txt", + "line": 3, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_194.txt", + "line": 4, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_195.txt", + "line": 4, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_196.txt", + "line": 4, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_197.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_199.txt", + "line": 3, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_200.txt", + "line": 10, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_200.txt", + "line": 11, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_201.txt", + "line": 7, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_201.txt", + "line": 19, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_204.txt", + "line": 2, + "type": "Basic Auth Credentials" + }, + { + "file": "secrets-examples/CKV_SECRET_207.txt", + "line": 3, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_208.txt", + "line": 3, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_213.txt", + "line": 2, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_216.txt", + "line": 3, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_218.txt", + "line": 2, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_218.txt", + "line": 3, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_22.txt", + "line": 3, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_220.txt", + "line": 2, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_222.txt", + "line": 2, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_222.txt", + "line": 4, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_222.txt", + "line": 4, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_223.txt", + "line": 8, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_225.txt", + "line": 5, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_225.txt", + "line": 5, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_226.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_226.txt", + "line": 1, + "type": "Slack Token" + }, + { + "file": "secrets-examples/CKV_SECRET_227.txt", + "line": 1, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_227.txt", + "line": 3, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_227.txt", + "line": 3, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_228.txt", + "line": 3, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_228.txt", + "line": 3, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_230.txt", + "line": 3, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_233.txt", + "line": 2, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_233.txt", + "line": 5, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_233.txt", + "line": 5, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_233.txt", + "line": 9, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_233.txt", + "line": 9, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_235_2.txt", + "line": 4, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_236.txt", + "line": 2, + "type": "Basic Auth Credentials" + }, + { + "file": "secrets-examples/CKV_SECRET_238.txt", + "line": 3, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_238.txt", + "line": 3, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_238.txt", + "line": 9, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_238.txt", + "line": 15, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_238.txt", + "line": 15, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_238.txt", + "line": 21, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_238.txt", + "line": 21, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_239.txt", + "line": 2, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_23_1.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_241.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_241.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_241.txt", + "line": 3, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_241.txt", + "line": 3, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_243.txt", + "line": 2, + "type": "Basic Auth Credentials" + }, + { + "file": "secrets-examples/CKV_SECRET_244.txt", + "line": 2, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_244.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_245.txt", + "line": 2, + "type": "Basic Auth Credentials" + }, + { + "file": "secrets-examples/CKV_SECRET_245.txt", + "line": 4, + "type": "Basic Auth Credentials" + }, + { + "file": "secrets-examples/CKV_SECRET_246.txt", + "line": 9, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_249.txt", + "line": 2, + "type": "JSON Web Token" + }, + { + "file": "secrets-examples/CKV_SECRET_249.txt", + "line": 7, + "type": "JSON Web Token" + }, + { + "file": "secrets-examples/CKV_SECRET_249.txt", + "line": 9, + "type": "JSON Web Token" + }, + { + "file": "secrets-examples/CKV_SECRET_249.txt", + "line": 11, + "type": "JSON Web Token" + }, + { + "file": "secrets-examples/CKV_SECRET_24_1.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_24_2.txt", + "line": 1, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_24_3.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_24_5.txt", + "line": 1, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_25.txt", + "line": 3, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_25.txt", + "line": 6, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_25.txt", + "line": 7, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_25.txt", + "line": 7, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_250.txt", + "line": 7, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_251.txt", + "line": 6, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_251.txt", + "line": 6, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_251.txt", + "line": 11, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_252.txt", + "line": 6, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_252.txt", + "line": 6, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_255.txt", + "line": 2, + "type": "Basic Auth Credentials" + }, + { + "file": "secrets-examples/CKV_SECRET_257_1.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_257_1.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_257_2.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_257_2.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_258_1.txt", + "line": 2, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_258_1.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_258_1.txt", + "line": 3, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_258_1.txt", + "line": 3, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_258_2.txt", + "line": 2, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_258_2.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_258_2.txt", + "line": 3, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_258_2.txt", + "line": 3, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_259_1.txt", + "line": 1, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_259_2.txt", + "line": 1, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_260_1.txt", + "line": 2, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_260_1.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_260_2.txt", + "line": 2, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_260_2.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_261_1.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_261_2.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_262.txt", + "line": 1, + "type": "Slack Token" + }, + { + "file": "secrets-examples/CKV_SECRET_263.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_264.txt", + "line": 5, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_264.txt", + "line": 5, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_265.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_265.txt", + "line": 2, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_266_1.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_266_2.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_267.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_268_1.txt", + "line": 4, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_268_2.txt", + "line": 3, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_268_2.txt", + "line": 3, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_269_3.txt", + "line": 1, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_269_3.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_269_4.txt", + "line": 1, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_269_4.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_26_1.txt", + "line": 2, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_27.txt", + "line": 1, + "type": "Basic Auth Credentials" + }, + { + "file": "secrets-examples/CKV_SECRET_270_1.txt", + "line": 3, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_270_1.txt", + "line": 4, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_270_2.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_270_2.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_271_1.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_271_1.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_272_1.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_272_1.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_272_2.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_273.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_273.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_274_1.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_274_2.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_274_2.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_274_3.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_275_2.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_276_1.txt", + "line": 1, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_276_2.txt", + "line": 1, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_277_1.txt", + "line": 1, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_277_2.txt", + "line": 1, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_278_1.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_278_1.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_278_2.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_278_3.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_279.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_279.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_279.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_282.txt", + "line": 1, + "type": "Basic Auth Credentials" + }, + { + "file": "secrets-examples/CKV_SECRET_283.txt", + "line": 1, + "type": "Basic Auth Credentials" + }, + { + "file": "secrets-examples/CKV_SECRET_284.txt", + "line": 4, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_285.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_286.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_287.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_289.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_289.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_28_1.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_28_2.txt", + "line": 1, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_28_2.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_28_3.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_291.txt", + "line": 1, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_293.txt", + "line": 1, + "type": "Azure Storage Account access key" + }, + { + "file": "secrets-examples/CKV_SECRET_295.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_295.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_296.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_297.txt", + "line": 3, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_300.txt", + "line": 1, + "type": "JSON Web Token" + }, + { + "file": "secrets-examples/CKV_SECRET_301.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_303.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_303.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_303.txt", + "line": 2, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_305.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_305.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_306.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_306.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_307.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_308.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_309.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_31.txt", + "line": 2, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_310.txt", + "line": 4, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_311.txt", + "line": 4, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_312.txt", + "line": 2, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_314.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_315.txt", + "line": 11, + "type": "Basic Auth Credentials" + }, + { + "file": "secrets-examples/CKV_SECRET_318.txt", + "line": 3, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_319.txt", + "line": 3, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_320.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_320.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_321.txt", + "line": 1, + "type": "JSON Web Token" + }, + { + "file": "secrets-examples/CKV_SECRET_322.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_32_1.txt", + "line": 2, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_333.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_42.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_43.txt", + "line": 1, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_45_1.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_46.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_46.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_51_1.txt", + "line": 4, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_51_2.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_53.txt", + "line": 2, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_53.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_54.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_56.txt", + "line": 2, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_56.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_64.txt", + "line": 1, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_65.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_72.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_73_3.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_73_5.txt", + "line": 1, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_73_5.txt", + "line": 1, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_74.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_77.txt", + "line": 1, + "type": "Basic Auth Credentials" + }, + { + "file": "secrets-examples/CKV_SECRET_77.txt", + "line": 2, + "type": "Basic Auth Credentials" + }, + { + "file": "secrets-examples/CKV_SECRET_78.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_79.txt", + "line": 6, + "type": "Private Key" + }, + { + "file": "secrets-examples/CKV_SECRET_79.txt", + "line": 10, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_79.txt", + "line": 18, + "type": "Private Key" + }, + { + "file": "secrets-examples/CKV_SECRET_82.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_83_2.txt", + "line": 2, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_84_1.txt", + "line": 2, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_84_2.txt", + "line": 1, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_86.txt", + "line": 2, + "type": "Hex High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_86.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_87_1.txt", + "line": 2, + "type": "SendGrid API Key" + }, + { + "file": "secrets-examples/CKV_SECRET_88.txt", + "line": 2, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_89.txt", + "line": 4, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_90.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_91_1.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_91_2.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_94.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_96_1.txt", + "line": 2, + "type": "Base64 High Entropy String" + }, + { + "file": "secrets-examples/CKV_SECRET_96_2.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_97.txt", + "line": 2, + "type": "Secret Keyword" + }, + { + "file": "secrets-examples/CKV_SECRET_98.txt", + "line": 3, + "type": "Secret Keyword" + } +] \ No newline at end of file diff --git a/baselines/perf-benchmark-baseline.json b/baselines/perf-benchmark-baseline.json new file mode 100644 index 000000000..d99f1b3ee --- /dev/null +++ b/baselines/perf-benchmark-baseline.json @@ -0,0 +1,13 @@ +{ + "scope": "3 modules from synthetic-code-repo", + "runs": 3, + "times": [ + 5.585217541003658, + 5.420311250003579, + 5.835190500001772 + ], + "mean": 5.613573097003003, + "median": 5.585217541003658, + "min": 5.420311250003579, + "findings": 6 +} \ No newline at end of file diff --git a/baselines/secrets-examples-baseline.json b/baselines/secrets-examples-baseline.json new file mode 100644 index 000000000..52491343d --- /dev/null +++ b/baselines/secrets-examples-baseline.json @@ -0,0 +1,3650 @@ +{ + "version": "1.5.47", + "plugins_used": [ + { + "name": "ArtifactoryDetector" + }, + { + "name": "AWSKeyDetector" + }, + { + "name": "AzureStorageKeyDetector" + }, + { + "name": "Base64HighEntropyString", + "limit": 4.5 + }, + { + "name": "BasicAuthDetector" + }, + { + "name": "CloudantDetector" + }, + { + "name": "DiscordBotTokenDetector" + }, + { + "name": "GitHubTokenDetector" + }, + { + "name": "HexHighEntropyString", + "limit": 3.0 + }, + { + "name": "IbmCloudIamDetector" + }, + { + "name": "IbmCosHmacDetector" + }, + { + "name": "JwtTokenDetector" + }, + { + "name": "KeywordDetector", + "keyword_exclude": "" + }, + { + "name": "MailchimpDetector" + }, + { + "name": "NpmDetector" + }, + { + "name": "PrivateKeyDetector" + }, + { + "name": "SendGridDetector" + }, + { + "name": "SlackDetector" + }, + { + "name": "SoftlayerDetector" + }, + { + "name": "SquareOAuthDetector" + }, + { + "name": "StripeDetector" + }, + { + "name": "TwilioKeyDetector" + } + ], + "filters_used": [ + { + "path": "detect_secrets.filters.allowlist.is_line_allowlisted" + }, + { + "path": "detect_secrets.filters.common.is_ignored_due_to_verification_policies", + "min_level": 2 + }, + { + "path": "detect_secrets.filters.heuristic.is_indirect_reference" + }, + { + "path": "detect_secrets.filters.heuristic.is_likely_id_string" + }, + { + "path": "detect_secrets.filters.heuristic.is_lock_file" + }, + { + "path": "detect_secrets.filters.heuristic.is_not_alphanumeric_string" + }, + { + "path": "detect_secrets.filters.heuristic.is_potential_uuid" + }, + { + "path": "detect_secrets.filters.heuristic.is_prefixed_with_dollar_sign" + }, + { + "path": "detect_secrets.filters.heuristic.is_sequential_string" + }, + { + "path": "detect_secrets.filters.heuristic.is_swagger_file" + }, + { + "path": "detect_secrets.filters.heuristic.is_templated_secret" + } + ], + "results": { + "secrets-examples/.git/config": [ + { + "type": "GitHub Token", + "filename": "secrets-examples/.git/config", + "hashed_secret": "e175c6f5f2a92e8623bd9a4820edb4e8c1b0fd10", + "is_verified": false, + "line_number": 9, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_101.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_101.txt", + "hashed_secret": "a7f517e0fadbbd8ad7da43cede125322ee2242ad", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_102_1.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_102_1.txt", + "hashed_secret": "1625768538da366442bdc87d22470fa9e383c8ff", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_102_2.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_102_2.txt", + "hashed_secret": "632839d056916834a3363a9424d7b527fddc0149", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_103.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_103.txt", + "hashed_secret": "c977fbd7303f7f3469b9898a8c509aec96f47cea", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_104_1.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_104_1.txt", + "hashed_secret": "7a87957ea9f971c339b03357b983f613b9c85b36", + "is_verified": false, + "line_number": 4, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_105.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_105.txt", + "hashed_secret": "e94158fb789b442eccd2e68c18ea5d8344498380", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_106.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_106.txt", + "hashed_secret": "b74a0d2455f71e0ae4d339b037eac318d5d0a279", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_107.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_107.txt", + "hashed_secret": "fb077b1a26b40f5e4f7a2707086436cbd6159b90", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_108.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_108.txt", + "hashed_secret": "e1f5ca066927b0cc614a45661735987f92338bf4", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_109.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_109.txt", + "hashed_secret": "e886d72f97f300a2ae26dd2b48424b0aea3f15e0", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_110.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_110.txt", + "hashed_secret": "4d26d29b4d10206d04b80a612cd35dadca0e39e5", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_112.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_112.txt", + "hashed_secret": "c6d994205c1f03b5a13e85ba29459830c5b580e9", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_113.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_113.txt", + "hashed_secret": "a404ad3346fe3d0135d3ff97b3b4ff384c39d099", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_113.txt", + "hashed_secret": "7c0dc64053d9501937b017c14fa4a48cd4974ec9", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_114.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_114.txt", + "hashed_secret": "2c6d3bc4dd360123cd0aadbe815562bafeb8d5fe", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_114.txt", + "hashed_secret": "81205d65591f4cfe45a1cc931bad183572b4ef0a", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_115.txt": [ + { + "type": "Azure Storage Account access key", + "filename": "secrets-examples/CKV_SECRET_115.txt", + "hashed_secret": "2724a50ea7b185f5315b9ecb9f8d5c8751ca5590", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + }, + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_115.txt", + "hashed_secret": "2724a50ea7b185f5315b9ecb9f8d5c8751ca5590", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_117.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_117.txt", + "hashed_secret": "7ce0359f12857f2a90c7de465f40a95f01cb5da9", + "is_verified": false, + "line_number": 4, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_118_2.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_118_2.txt", + "hashed_secret": "810c8e67749e3b89e61e7b2c2d10a4b76e12dc9e", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_118_2.txt", + "hashed_secret": "8a9117f2d655d4603c10fd7b376137ba749d8c6d", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_118_2.txt", + "hashed_secret": "8a9117f2d655d4603c10fd7b376137ba749d8c6d", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_12.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_12.txt", + "hashed_secret": "00eb109211a40a18e7efc2509f18b63b55dae720", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "NPM tokens", + "filename": "secrets-examples/CKV_SECRET_12.txt", + "hashed_secret": "b35532a347c95a255bc5dcfd593021fc1bfbc0fe", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_121.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_121.txt", + "hashed_secret": "c543b78653c244e744adfbe7158400f8abff12d9", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_122.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_122.txt", + "hashed_secret": "48c20637612a5b7eecdcbe4ba88d43f2f932eb3a", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_124.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_124.txt", + "hashed_secret": "9d9651bd5e4dcd433cf09ed8ae2149cf1baa2f10", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_125_2.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_125_2.txt", + "hashed_secret": "7847f909bb97a471e34a442cab91a95c21afd3dd", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_125_2.txt", + "hashed_secret": "7847f909bb97a471e34a442cab91a95c21afd3dd", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + }, + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_125_2.txt", + "hashed_secret": "57b08d6fdf129f8f01da9705b8adbe8dceffd710", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_125_2.txt", + "hashed_secret": "57b08d6fdf129f8f01da9705b8adbe8dceffd710", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_126_1.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_126_1.txt", + "hashed_secret": "57b08d6fdf129f8f01da9705b8adbe8dceffd710", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_126_2.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_126_2.txt", + "hashed_secret": "7847f909bb97a471e34a442cab91a95c21afd3dd", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_126_2.txt", + "hashed_secret": "7847f909bb97a471e34a442cab91a95c21afd3dd", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + }, + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_126_2.txt", + "hashed_secret": "57b08d6fdf129f8f01da9705b8adbe8dceffd710", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_126_2.txt", + "hashed_secret": "57b08d6fdf129f8f01da9705b8adbe8dceffd710", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_127.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_127.txt", + "hashed_secret": "28292bc0843a289f2427ff29c891153c71f64332", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + }, + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_127.txt", + "hashed_secret": "5176b7a0453c9dcaff47c0a44aaf8fc088ff6869", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + }, + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_127.txt", + "hashed_secret": "0d4c4630622e2c02012903c1ddb147478c7982d0", + "is_verified": false, + "line_number": 4, + "is_added": false, + "is_removed": false + }, + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_127.txt", + "hashed_secret": "6a6535d920f150194f97ff09f27b9a0490264ed4", + "is_verified": false, + "line_number": 6, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_128.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_128.txt", + "hashed_secret": "3136b916ed0f1cd86f53e7aff567d2d30a2a1ab5", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + }, + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_128.txt", + "hashed_secret": "5176b7a0453c9dcaff47c0a44aaf8fc088ff6869", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_132.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_132.txt", + "hashed_secret": "c6b610aca19a2cf231f3069cc3676c2aa01e90c0", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_133.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_133.txt", + "hashed_secret": "f7d5a1f2a07965702eb382a248752c780b7855b2", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_134.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_134.txt", + "hashed_secret": "0e5615bbeaa26e64e7f020d2810259bc3cb1cbd7", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_135.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_135.txt", + "hashed_secret": "954a37c705ff6a260883d24d51369b06b697f18e", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_136.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_136.txt", + "hashed_secret": "178214264077cd36603258e21b07d6dbf0bbeca2", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_137_1.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_137_1.txt", + "hashed_secret": "468ebb99ed9a98137439115ed7acd77d6c1e1a7b", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_137_1.txt", + "hashed_secret": "468ebb99ed9a98137439115ed7acd77d6c1e1a7b", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_137_2.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_137_2.txt", + "hashed_secret": "763e68bba00e638d3eef6b962ac16c3df6c85577", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_139.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_139.txt", + "hashed_secret": "520dc9f0f605449410fac6d06bee404f5bbf03e6", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_142.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_142.txt", + "hashed_secret": "de0dde6ae7a74e64fb302037bae6a4444934c3bc", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_142.txt", + "hashed_secret": "de0dde6ae7a74e64fb302037bae6a4444934c3bc", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_143_1.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_143_1.txt", + "hashed_secret": "18cb5dda884980b665007f5a15dc97e2e61d9bdf", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_143_1.txt", + "hashed_secret": "18cb5dda884980b665007f5a15dc97e2e61d9bdf", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_143_2.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_143_2.txt", + "hashed_secret": "e5915fd24da9a6ba97a275f9ce2429a72e596cf3", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_143_2.txt", + "hashed_secret": "e5915fd24da9a6ba97a275f9ce2429a72e596cf3", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_144.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_144.txt", + "hashed_secret": "d2f33570b5737912f8f9d8dd6cb9f435c5414774", + "is_verified": false, + "line_number": 4, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_145.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_145.txt", + "hashed_secret": "0b458a242d416a8d6f5dbe5cdbe47002d66cc498", + "is_verified": false, + "line_number": 4, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_145.txt", + "hashed_secret": "0b458a242d416a8d6f5dbe5cdbe47002d66cc498", + "is_verified": false, + "line_number": 4, + "is_added": false, + "is_removed": false + }, + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_145.txt", + "hashed_secret": "f64f3f7294f052d7f2acc0636175070da86d9724", + "is_verified": false, + "line_number": 8, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_146.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_146.txt", + "hashed_secret": "adb66782d8f173b29a9f8831e00b4b30618199fc", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_147.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_147.txt", + "hashed_secret": "46610eb8c48b5cdf59b508e1779df53cbba8d13b", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_147.txt", + "hashed_secret": "46610eb8c48b5cdf59b508e1779df53cbba8d13b", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + }, + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_147.txt", + "hashed_secret": "e9b3098f15e9d69737c6ad40935b51a08fe86c69", + "is_verified": false, + "line_number": 7, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_147.txt", + "hashed_secret": "e9b3098f15e9d69737c6ad40935b51a08fe86c69", + "is_verified": false, + "line_number": 7, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_149.txt": [ + { + "type": "Basic Auth Credentials", + "filename": "secrets-examples/CKV_SECRET_149.txt", + "hashed_secret": "d8efd0cb77ba0cdf132d242df3617ebb9598f47e", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + }, + { + "type": "Basic Auth Credentials", + "filename": "secrets-examples/CKV_SECRET_149.txt", + "hashed_secret": "1951f58f463599e04543731a7e0c5bd0916d23f7", + "is_verified": false, + "line_number": 4, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_149.txt", + "hashed_secret": "2f9780a53df155750859dfb10532de4cfc05f795", + "is_verified": false, + "line_number": 13, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_150.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_150.txt", + "hashed_secret": "4da43dabb1f9f41b7162aa04950bcbacbcbaade4", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_151.txt": [ + { + "type": "Basic Auth Credentials", + "filename": "secrets-examples/CKV_SECRET_151.txt", + "hashed_secret": "d8efd0cb77ba0cdf132d242df3617ebb9598f47e", + "is_verified": false, + "line_number": 8, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_152.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_152.txt", + "hashed_secret": "9deb7064c0554d6f91d2863dbfa3f72debd6ce30", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_153.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_153.txt", + "hashed_secret": "95a38a4fa01870af4f91dc347de5df817b2ddcfa", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_155.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_155.txt", + "hashed_secret": "03c17f4896826e4b9838798a41a402ee8c97b774", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_157_2.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_157_2.txt", + "hashed_secret": "2c5d02685059f7c3f76c36af282e2377ce286928", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_157_3.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_157_3.txt", + "hashed_secret": "2c5d02685059f7c3f76c36af282e2377ce286928", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_158.txt": [ + { + "type": "Basic Auth Credentials", + "filename": "secrets-examples/CKV_SECRET_158.txt", + "hashed_secret": "4b4cbcb8926324ed9c35f423d6f9c97d7d8f7372", + "is_verified": false, + "line_number": 5, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_159.txt": [ + { + "type": "Basic Auth Credentials", + "filename": "secrets-examples/CKV_SECRET_159.txt", + "hashed_secret": "4b4cbcb8926324ed9c35f423d6f9c97d7d8f7372", + "is_verified": false, + "line_number": 5, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_162.txt": [ + { + "type": "Basic Auth Credentials", + "filename": "secrets-examples/CKV_SECRET_162.txt", + "hashed_secret": "5b4c2516fe7ac7a96c31d4b80f2193acb65134c2", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Basic Auth Credentials", + "filename": "secrets-examples/CKV_SECRET_162.txt", + "hashed_secret": "fc1e6a054d4d8fb12ff08a0c4b33975887f0a305", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_163.txt": [ + { + "type": "Basic Auth Credentials", + "filename": "secrets-examples/CKV_SECRET_163.txt", + "hashed_secret": "5b4c2516fe7ac7a96c31d4b80f2193acb65134c2", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Basic Auth Credentials", + "filename": "secrets-examples/CKV_SECRET_163.txt", + "hashed_secret": "fc1e6a054d4d8fb12ff08a0c4b33975887f0a305", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_164.txt": [ + { + "type": "Basic Auth Credentials", + "filename": "secrets-examples/CKV_SECRET_164.txt", + "hashed_secret": "40eb2b64ea1c4911f6551624c3a3da97da8e0e3a", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Basic Auth Credentials", + "filename": "secrets-examples/CKV_SECRET_164.txt", + "hashed_secret": "edfe2f203a4c9a6a0defe27b9ba176b7d89cd337", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_165.txt": [ + { + "type": "Basic Auth Credentials", + "filename": "secrets-examples/CKV_SECRET_165.txt", + "hashed_secret": "40eb2b64ea1c4911f6551624c3a3da97da8e0e3a", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Basic Auth Credentials", + "filename": "secrets-examples/CKV_SECRET_165.txt", + "hashed_secret": "edfe2f203a4c9a6a0defe27b9ba176b7d89cd337", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_166.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_166.txt", + "hashed_secret": "8c6e5f9953d1243f5b8b5c4901f3000942d7bb25", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_167.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_167.txt", + "hashed_secret": "30f6ab8863e83ea83549e8ca2d02d7c4b5a81ac8", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_167.txt", + "hashed_secret": "30f6ab8863e83ea83549e8ca2d02d7c4b5a81ac8", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + }, + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_167.txt", + "hashed_secret": "6dd04fda792ca523c492284a83f2c61ae0026043", + "is_verified": false, + "line_number": 5, + "is_added": false, + "is_removed": false + }, + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_167.txt", + "hashed_secret": "3debc25ee2a41be6c24e53f46c395e13bf9bbb00", + "is_verified": false, + "line_number": 7, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_168.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_168.txt", + "hashed_secret": "9fa7c3af605a4d98e4ccbc5553567ff3aef24db8", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_168.txt", + "hashed_secret": "ef9ff3de94e83f2361329e2356f118b8b2ec90a8", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_169.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_169.txt", + "hashed_secret": "1ddf8ebe992b96a3b39b3e7fcdde76f3a43ee915", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + }, + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_169.txt", + "hashed_secret": "8b13d2f204851f82701fe8dc9ac9914d6204ed30", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_170.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_170.txt", + "hashed_secret": "4482c7a132917bf9385a37c72867b58788b0c595", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + }, + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_170.txt", + "hashed_secret": "61f4b954a72988d2a3ed2970f84f8a59d3718aa7", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_172.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_172.txt", + "hashed_secret": "1629ddd56acd65add224ee10d0a0c837b8e7a52e", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_173.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_173.txt", + "hashed_secret": "4d8d06ac44f1e3936c15407cb4265bff5670dca1", + "is_verified": false, + "line_number": 7, + "is_added": false, + "is_removed": false + }, + { + "type": "Private Key", + "filename": "secrets-examples/CKV_SECRET_173.txt", + "hashed_secret": "342d72b7ea1f41f97ef671dcec803d6c4093e8f5", + "is_verified": false, + "line_number": 10, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_176.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_176.txt", + "hashed_secret": "36005583472d39943505d9fdfd1e35b3dd28bf54", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + }, + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_176.txt", + "hashed_secret": "e1c2bcdb4ff911774b43045f52ae0dbab3c78da7", + "is_verified": false, + "line_number": 4, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_176.txt", + "hashed_secret": "e1c2bcdb4ff911774b43045f52ae0dbab3c78da7", + "is_verified": false, + "line_number": 4, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_177.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_177.txt", + "hashed_secret": "976183af99348f1ce20679fe7f7f35ced7aa8960", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_178_1.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_178_1.txt", + "hashed_secret": "0fe5d090e8d8f0d8b1fdf70e62704b166866e16b", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + }, + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_178_1.txt", + "hashed_secret": "3608b3a9d8e84a6fe2ce4a4485353210788b21d1", + "is_verified": false, + "line_number": 8, + "is_added": false, + "is_removed": false + }, + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_178_1.txt", + "hashed_secret": "c3674b5d3aea9f37cafeb7a6b9890d583f11b510", + "is_verified": false, + "line_number": 11, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_180.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_180.txt", + "hashed_secret": "f9d01f0758581aa0e2901a148686d211d05d3bc1", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + }, + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_180.txt", + "hashed_secret": "8d419aca116159ea58a2eaf24a15bc58b9d9c0f3", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_182.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_182.txt", + "hashed_secret": "ee1b507610b2d8c366ece22a8d89c6487c710db5", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_183.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_183.txt", + "hashed_secret": "ee1b507610b2d8c366ece22a8d89c6487c710db5", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_185.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_185.txt", + "hashed_secret": "e5376faee3203102614b3ba5dd4fccf6dfae0753", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_191.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_191.txt", + "hashed_secret": "dafd533b6bfa31dbb2d22b33840a3e4ae956f25f", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_194.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_194.txt", + "hashed_secret": "c47b528638f3906d33c414570ca62386a3fcb631", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_194.txt", + "hashed_secret": "1ec4ac7c51d9bad305bd720649d4280bddc5c06a", + "is_verified": false, + "line_number": 4, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_195.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_195.txt", + "hashed_secret": "ffffa5aa5fa3a79a7c571819bc70068d887750db", + "is_verified": false, + "line_number": 4, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_196.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_196.txt", + "hashed_secret": "ffffa5aa5fa3a79a7c571819bc70068d887750db", + "is_verified": false, + "line_number": 4, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_197.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_197.txt", + "hashed_secret": "82e82d9c6a157468581f7956f36dd5c64525e8a6", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_199.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_199.txt", + "hashed_secret": "ca6898e32da4bf49bd3502e15853719d31d168e0", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_200.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_200.txt", + "hashed_secret": "262692da25b330957a303271fd51141baab615a1", + "is_verified": false, + "line_number": 10, + "is_added": false, + "is_removed": false + }, + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_200.txt", + "hashed_secret": "9f9155d8a96c046eb21487bf6af4581c90b95fa0", + "is_verified": false, + "line_number": 11, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_201.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_201.txt", + "hashed_secret": "6eeab84f99790326e05e6b4c18bc88ac3583cd19", + "is_verified": false, + "line_number": 7, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_201.txt", + "hashed_secret": "858d1a1f5ac8c6a904da514de1cf4d64bff5c408", + "is_verified": false, + "line_number": 19, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_204.txt": [ + { + "type": "Basic Auth Credentials", + "filename": "secrets-examples/CKV_SECRET_204.txt", + "hashed_secret": "c70900ba5ed78187a931b8943e88938ef7b5e115", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_207.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_207.txt", + "hashed_secret": "c4055cd1b0ef490d2235228161fb6e4f80c56c00", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_208.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_208.txt", + "hashed_secret": "055a7f7f66302f5dd3c0eaa79e7fa4367f617625", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_213.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_213.txt", + "hashed_secret": "da02d9f57c0d37f9c8fe13298c8054bac9024263", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_216.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_216.txt", + "hashed_secret": "b5fd3594850e9b1386e742c92c7be3aba2b66174", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_218.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_218.txt", + "hashed_secret": "3060f975694da6fc4450bfa2ebec6139ef23bfb3", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + }, + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_218.txt", + "hashed_secret": "6c8f55b88b96c4b90e6339da4575304b2b587dd4", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_22.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_22.txt", + "hashed_secret": "f3c1a8c52eca659080df90580126aa759a5d7ccf", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_220.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_220.txt", + "hashed_secret": "df4c3eee056882ace1ad76d65cce0dc6ac7c9013", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_222.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_222.txt", + "hashed_secret": "a2b9255f78df9c3fc4d6fb336ae5d7c2479eca2c", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + }, + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_222.txt", + "hashed_secret": "0c3bf28285b4338ba512359e3bfbd0f396ff8341", + "is_verified": false, + "line_number": 4, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_222.txt", + "hashed_secret": "0c3bf28285b4338ba512359e3bfbd0f396ff8341", + "is_verified": false, + "line_number": 4, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_223.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_223.txt", + "hashed_secret": "cba687ce3e57318b7ae8b9c037898e353b6a607b", + "is_verified": false, + "line_number": 8, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_225.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_225.txt", + "hashed_secret": "1e7d4a8489b08cc545cb2d19cd3ad55299f8738a", + "is_verified": false, + "line_number": 5, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_225.txt", + "hashed_secret": "1e7d4a8489b08cc545cb2d19cd3ad55299f8738a", + "is_verified": false, + "line_number": 5, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_226.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_226.txt", + "hashed_secret": "fa98f5440308feed6d2e21c112a0e17381a28888", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Slack Token", + "filename": "secrets-examples/CKV_SECRET_226.txt", + "hashed_secret": "fa98f5440308feed6d2e21c112a0e17381a28888", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_227.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_227.txt", + "hashed_secret": "5b008c692e08cabb7d733f45ec0d9683ca12363b", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_227.txt", + "hashed_secret": "7e2ca292a54b08446c633dc05ae6d4c382d8fb08", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_227.txt", + "hashed_secret": "7e2ca292a54b08446c633dc05ae6d4c382d8fb08", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_228.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_228.txt", + "hashed_secret": "5c49c653a76b96434d244751a3b9dcda398408b7", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_228.txt", + "hashed_secret": "5c49c653a76b96434d244751a3b9dcda398408b7", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_230.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_230.txt", + "hashed_secret": "0a0143105f01cd167ac9c1867d00684161de1d49", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_233.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_233.txt", + "hashed_secret": "d7d9f34f2b7f128147bd01825d503926d13deee7", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + }, + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_233.txt", + "hashed_secret": "1227057cbfc48c4e36c0480d33137fffe69a27b7", + "is_verified": false, + "line_number": 5, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_233.txt", + "hashed_secret": "1227057cbfc48c4e36c0480d33137fffe69a27b7", + "is_verified": false, + "line_number": 5, + "is_added": false, + "is_removed": false + }, + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_233.txt", + "hashed_secret": "bdd3fa32aef0f831ba43f8891b437ac3ae5bbf20", + "is_verified": false, + "line_number": 9, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_233.txt", + "hashed_secret": "bdd3fa32aef0f831ba43f8891b437ac3ae5bbf20", + "is_verified": false, + "line_number": 9, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_235_2.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_235_2.txt", + "hashed_secret": "1382c2e3645d108e765c1c32c48fdcf78fc72171", + "is_verified": false, + "line_number": 4, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_236.txt": [ + { + "type": "Basic Auth Credentials", + "filename": "secrets-examples/CKV_SECRET_236.txt", + "hashed_secret": "0ed03ccd11035be1213bb146b88d2cb41eaf780c", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_238.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_238.txt", + "hashed_secret": "000a71ef8d251b35f4e1c4f4053c884c5c59886e", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_238.txt", + "hashed_secret": "000a71ef8d251b35f4e1c4f4053c884c5c59886e", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + }, + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_238.txt", + "hashed_secret": "6b320cd9eb13164e5aa94da759225cd04f79dd11", + "is_verified": false, + "line_number": 9, + "is_added": false, + "is_removed": false + }, + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_238.txt", + "hashed_secret": "a16ef0ba6ecd8108f11c9e88fb575ee70a9019b1", + "is_verified": false, + "line_number": 15, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_238.txt", + "hashed_secret": "a16ef0ba6ecd8108f11c9e88fb575ee70a9019b1", + "is_verified": false, + "line_number": 15, + "is_added": false, + "is_removed": false + }, + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_238.txt", + "hashed_secret": "b63ea6e350a706e6571f07e3464b28bebd964b80", + "is_verified": false, + "line_number": 21, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_238.txt", + "hashed_secret": "b63ea6e350a706e6571f07e3464b28bebd964b80", + "is_verified": false, + "line_number": 21, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_239.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_239.txt", + "hashed_secret": "baff70f54bcf9303a756ba478bbe2ef69d30d8ee", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_23_1.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_23_1.txt", + "hashed_secret": "1839ce29295f218beb7b1466a47892ce3f923f79", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_241.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_241.txt", + "hashed_secret": "143da3cb307032304566df08c2eb32aeccb68249", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_241.txt", + "hashed_secret": "143da3cb307032304566df08c2eb32aeccb68249", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_241.txt", + "hashed_secret": "95376491eb10af2905f04742d26d5ab0a9e29a9e", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_241.txt", + "hashed_secret": "95376491eb10af2905f04742d26d5ab0a9e29a9e", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_243.txt": [ + { + "type": "Basic Auth Credentials", + "filename": "secrets-examples/CKV_SECRET_243.txt", + "hashed_secret": "bcf0c1ab350f663dec5dd2871ca4ec270f4f00e6", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_244.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_244.txt", + "hashed_secret": "b808f3aedc82ff95c28260f3dcda1952c022f666", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_244.txt", + "hashed_secret": "b808f3aedc82ff95c28260f3dcda1952c022f666", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_245.txt": [ + { + "type": "Basic Auth Credentials", + "filename": "secrets-examples/CKV_SECRET_245.txt", + "hashed_secret": "0b42321b2c5c3d443efd49238471b27577b145a3", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + }, + { + "type": "Basic Auth Credentials", + "filename": "secrets-examples/CKV_SECRET_245.txt", + "hashed_secret": "733a6f02cf9bb12eb06cdb44fd91e3109415d000", + "is_verified": false, + "line_number": 4, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_246.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_246.txt", + "hashed_secret": "9990c18b44c6f5f449b3c30ee023753b15d7648a", + "is_verified": false, + "line_number": 9, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_249.txt": [ + { + "type": "JSON Web Token", + "filename": "secrets-examples/CKV_SECRET_249.txt", + "hashed_secret": "59ba5ebfbcf5d4e41ea207f10d3d1b60a6e6ddd7", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + }, + { + "type": "JSON Web Token", + "filename": "secrets-examples/CKV_SECRET_249.txt", + "hashed_secret": "d411f484c14a5b76616f7083e72b5238a4678480", + "is_verified": false, + "line_number": 7, + "is_added": false, + "is_removed": false + }, + { + "type": "JSON Web Token", + "filename": "secrets-examples/CKV_SECRET_249.txt", + "hashed_secret": "8fee2031f7bbd6852169e7b621f2dfe51e3687d3", + "is_verified": false, + "line_number": 9, + "is_added": false, + "is_removed": false + }, + { + "type": "JSON Web Token", + "filename": "secrets-examples/CKV_SECRET_249.txt", + "hashed_secret": "edd6aadf61a0ce52182465fb3d9a6c0710ac3fb2", + "is_verified": false, + "line_number": 11, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_24_1.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_24_1.txt", + "hashed_secret": "91b9e8a32c5c4f55cc3933ccdb7a3f2323029967", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_24_2.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_24_2.txt", + "hashed_secret": "8ec3ffa32f91ae4a161a7386db0018a448154476", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_24_3.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_24_3.txt", + "hashed_secret": "a297c75268eb2515ae311da59db3a5a92a3f0f58", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_24_5.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_24_5.txt", + "hashed_secret": "56867f126980fc9c6193b7134ff5a3b4fa7c3705", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_25.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_25.txt", + "hashed_secret": "a0625428376dea9f6b44fbcec6020b967a1d13f5", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + }, + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_25.txt", + "hashed_secret": "710168c9f8c92e07726baee6453974bd1af138d6", + "is_verified": false, + "line_number": 6, + "is_added": false, + "is_removed": false + }, + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_25.txt", + "hashed_secret": "0cff3b98d8442ec6e7cbbfdc0fc76cf6cb02c9b5", + "is_verified": false, + "line_number": 7, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_25.txt", + "hashed_secret": "0cff3b98d8442ec6e7cbbfdc0fc76cf6cb02c9b5", + "is_verified": false, + "line_number": 7, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_250.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_250.txt", + "hashed_secret": "a47bfa5a936a632f4f21eada418002556ca187bd", + "is_verified": false, + "line_number": 7, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_251.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_251.txt", + "hashed_secret": "77910b7e21bcd19b743a3d502dbdb3d2830f709b", + "is_verified": false, + "line_number": 6, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_251.txt", + "hashed_secret": "77910b7e21bcd19b743a3d502dbdb3d2830f709b", + "is_verified": false, + "line_number": 6, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_251.txt", + "hashed_secret": "bba568fe6e7f9325022d865caf5f9711b87468d8", + "is_verified": false, + "line_number": 11, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_252.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_252.txt", + "hashed_secret": "77910b7e21bcd19b743a3d502dbdb3d2830f709b", + "is_verified": false, + "line_number": 6, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_252.txt", + "hashed_secret": "77910b7e21bcd19b743a3d502dbdb3d2830f709b", + "is_verified": false, + "line_number": 6, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_255.txt": [ + { + "type": "Basic Auth Credentials", + "filename": "secrets-examples/CKV_SECRET_255.txt", + "hashed_secret": "863bc85faee98e2eb4cfcf25cd69333f8eef79c4", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_257_1.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_257_1.txt", + "hashed_secret": "67d9a8506018be0575aa7b82ef7aaa6a9b21fd15", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_257_1.txt", + "hashed_secret": "67d9a8506018be0575aa7b82ef7aaa6a9b21fd15", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_257_2.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_257_2.txt", + "hashed_secret": "67d9a8506018be0575aa7b82ef7aaa6a9b21fd15", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_257_2.txt", + "hashed_secret": "67d9a8506018be0575aa7b82ef7aaa6a9b21fd15", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_258_1.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_258_1.txt", + "hashed_secret": "846c10a0d55d5ec89b8f39a96a6bfbc449be14d8", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_258_1.txt", + "hashed_secret": "846c10a0d55d5ec89b8f39a96a6bfbc449be14d8", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + }, + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_258_1.txt", + "hashed_secret": "85ce1e5f839fa5aa4dc0b2952fa8e58940f153f6", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_258_1.txt", + "hashed_secret": "85ce1e5f839fa5aa4dc0b2952fa8e58940f153f6", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_258_2.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_258_2.txt", + "hashed_secret": "846c10a0d55d5ec89b8f39a96a6bfbc449be14d8", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_258_2.txt", + "hashed_secret": "846c10a0d55d5ec89b8f39a96a6bfbc449be14d8", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + }, + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_258_2.txt", + "hashed_secret": "85ce1e5f839fa5aa4dc0b2952fa8e58940f153f6", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_258_2.txt", + "hashed_secret": "85ce1e5f839fa5aa4dc0b2952fa8e58940f153f6", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_259_1.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_259_1.txt", + "hashed_secret": "4b3fe7050935d795ed7098db8f93f18018673709", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_259_2.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_259_2.txt", + "hashed_secret": "4b3fe7050935d795ed7098db8f93f18018673709", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_260_1.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_260_1.txt", + "hashed_secret": "b1bb2fb49b7bba284e70b195c5328f44aae8251c", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_260_1.txt", + "hashed_secret": "b1bb2fb49b7bba284e70b195c5328f44aae8251c", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_260_2.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_260_2.txt", + "hashed_secret": "b1bb2fb49b7bba284e70b195c5328f44aae8251c", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_260_2.txt", + "hashed_secret": "b1bb2fb49b7bba284e70b195c5328f44aae8251c", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_261_1.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_261_1.txt", + "hashed_secret": "0ce624173c0f1f3a4d14203161d188e521072eef", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_261_2.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_261_2.txt", + "hashed_secret": "0ce624173c0f1f3a4d14203161d188e521072eef", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_262.txt": [ + { + "type": "Slack Token", + "filename": "secrets-examples/CKV_SECRET_262.txt", + "hashed_secret": "874207108966ff7ed0a8f8a80dc24308b96f52f2", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_263.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_263.txt", + "hashed_secret": "181e72926efb67e0a35b68401b615285d1cd5c9e", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_264.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_264.txt", + "hashed_secret": "f9ce3ab267e987e4f15a5fdb9611864035bf75ad", + "is_verified": false, + "line_number": 5, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_264.txt", + "hashed_secret": "f9ce3ab267e987e4f15a5fdb9611864035bf75ad", + "is_verified": false, + "line_number": 5, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_265.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_265.txt", + "hashed_secret": "7886b97bc8afba5d86439e628d50afbac755c1e0", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_265.txt", + "hashed_secret": "8b288668f36bb93e9710d74fabe749b54a4c2a33", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_266_1.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_266_1.txt", + "hashed_secret": "a9a9a50343d1fc9e36332770cf9cc4f00538c6b6", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_266_2.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_266_2.txt", + "hashed_secret": "1d606f3a3f0b4c791343daa9a51b6fdd33023a1e", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_267.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_267.txt", + "hashed_secret": "a9a9a50343d1fc9e36332770cf9cc4f00538c6b6", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_268_1.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_268_1.txt", + "hashed_secret": "564ad635413b5c7b273d3192702561e75e345ffb", + "is_verified": false, + "line_number": 4, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_268_2.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_268_2.txt", + "hashed_secret": "564ad635413b5c7b273d3192702561e75e345ffb", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_268_2.txt", + "hashed_secret": "564ad635413b5c7b273d3192702561e75e345ffb", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_269_3.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_269_3.txt", + "hashed_secret": "52626acbd7a2d1ab8c90f6e38b745b73ac6111cb", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_269_3.txt", + "hashed_secret": "52626acbd7a2d1ab8c90f6e38b745b73ac6111cb", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_269_4.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_269_4.txt", + "hashed_secret": "52626acbd7a2d1ab8c90f6e38b745b73ac6111cb", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_269_4.txt", + "hashed_secret": "52626acbd7a2d1ab8c90f6e38b745b73ac6111cb", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_26_1.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_26_1.txt", + "hashed_secret": "2ac49c95d3eb6bd0336b9ab69813a615379fe2eb", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_27.txt": [ + { + "type": "Basic Auth Credentials", + "filename": "secrets-examples/CKV_SECRET_27.txt", + "hashed_secret": "d72e0259520e3e82817a3c085d7ed55acd178d49", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_270_1.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_270_1.txt", + "hashed_secret": "5b12afe5e96218ae7cac460dc3891287a61224f2", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + }, + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_270_1.txt", + "hashed_secret": "f26cef46dedd10c94793f51e7e3d60292e150555", + "is_verified": false, + "line_number": 4, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_270_2.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_270_2.txt", + "hashed_secret": "9223f03259f52c9b91e9ad1462cb4f501c4a129d", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_270_2.txt", + "hashed_secret": "9223f03259f52c9b91e9ad1462cb4f501c4a129d", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_271_1.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_271_1.txt", + "hashed_secret": "05d2ea17dd7ccd82d51a547156ad0742be3a8117", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_271_1.txt", + "hashed_secret": "05d2ea17dd7ccd82d51a547156ad0742be3a8117", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_272_1.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_272_1.txt", + "hashed_secret": "bcb10035bcb64b6a7aa72b5697e4340eb5547762", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_272_1.txt", + "hashed_secret": "bcb10035bcb64b6a7aa72b5697e4340eb5547762", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_272_2.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_272_2.txt", + "hashed_secret": "91cd1de8f3c4533996020cc0a8e5d1dbdc2f3982", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_273.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_273.txt", + "hashed_secret": "21186b7a5d366560b97f6b5d63a202d062341b81", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_273.txt", + "hashed_secret": "21186b7a5d366560b97f6b5d63a202d062341b81", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_274_1.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_274_1.txt", + "hashed_secret": "145f7d6bee464e964eff64a16358f6d0c58dae64", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_274_2.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_274_2.txt", + "hashed_secret": "d687156b2cf97fc5a1dd2a1007adffb018859db0", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_274_2.txt", + "hashed_secret": "d687156b2cf97fc5a1dd2a1007adffb018859db0", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_274_3.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_274_3.txt", + "hashed_secret": "145f7d6bee464e964eff64a16358f6d0c58dae64", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_275_2.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_275_2.txt", + "hashed_secret": "224bc25d315f0522c77ba6d7414f0aa86dcedc8b", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_276_1.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_276_1.txt", + "hashed_secret": "2dee1209155117c4d70e9259550e1f1edb755b28", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_276_2.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_276_2.txt", + "hashed_secret": "2dee1209155117c4d70e9259550e1f1edb755b28", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_277_1.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_277_1.txt", + "hashed_secret": "2dee1209155117c4d70e9259550e1f1edb755b28", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_277_2.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_277_2.txt", + "hashed_secret": "2dee1209155117c4d70e9259550e1f1edb755b28", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_278_1.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_278_1.txt", + "hashed_secret": "acd0187ead8c56cb594237df2d20d3a0f6a2707e", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_278_1.txt", + "hashed_secret": "acd0187ead8c56cb594237df2d20d3a0f6a2707e", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_278_2.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_278_2.txt", + "hashed_secret": "acd0187ead8c56cb594237df2d20d3a0f6a2707e", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_278_3.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_278_3.txt", + "hashed_secret": "acd0187ead8c56cb594237df2d20d3a0f6a2707e", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_279.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_279.txt", + "hashed_secret": "c2978cb7bb4120804ed5ae0f83d64604e2a8b397", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_279.txt", + "hashed_secret": "cc782fac57aed79fe273233ce584ed3c4522e1e5", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_279.txt", + "hashed_secret": "db6f20cbf1d3d376d3fe9a9c9a3b98d403af8f15", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_282.txt": [ + { + "type": "Basic Auth Credentials", + "filename": "secrets-examples/CKV_SECRET_282.txt", + "hashed_secret": "00d04288fcdc032e3397a08714094a1180f131c8", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_283.txt": [ + { + "type": "Basic Auth Credentials", + "filename": "secrets-examples/CKV_SECRET_283.txt", + "hashed_secret": "f1d6946f64c7d665ff5ad6ff4ac0852b8f1c8975", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_284.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_284.txt", + "hashed_secret": "69edf523771536f4ac1c50ffb14c492020d7caae", + "is_verified": false, + "line_number": 4, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_285.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_285.txt", + "hashed_secret": "ae0258fec62b7f43e5b7203660e824475d94d252", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_286.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_286.txt", + "hashed_secret": "8250246712a3742e793596eb8cee479b9de36aa7", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_287.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_287.txt", + "hashed_secret": "15c760ddffe01e100898ee2af14b697d750ebadc", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_289.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_289.txt", + "hashed_secret": "e17af0f5b3444990ca8a708305983df349f8892b", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_289.txt", + "hashed_secret": "e17af0f5b3444990ca8a708305983df349f8892b", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_28_1.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_28_1.txt", + "hashed_secret": "b264097c1f993b2c805134b511fc70ff8867691d", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_28_2.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_28_2.txt", + "hashed_secret": "189dcc982bb8a72ee6342664c0c19105b00cf9e1", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_28_2.txt", + "hashed_secret": "189dcc982bb8a72ee6342664c0c19105b00cf9e1", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_28_3.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_28_3.txt", + "hashed_secret": "26de3669908874d9493dd9f4333a696720db076d", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_291.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_291.txt", + "hashed_secret": "ceb5535cf9862f88f83e3f42f9ebf9b143cd984d", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_293.txt": [ + { + "type": "Azure Storage Account access key", + "filename": "secrets-examples/CKV_SECRET_293.txt", + "hashed_secret": "3f0aa5c9703cd3302e94e2409b01cef1f7826f77", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_295.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_295.txt", + "hashed_secret": "454dfac6c4cac9b10f1159b13e0335bd2268fa68", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_295.txt", + "hashed_secret": "fe85721a577a2a36838b38fefdbdc80d2616aa03", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_296.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_296.txt", + "hashed_secret": "1410cad8829e23e2d88b9cf6c6130767c4dfa0d5", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_297.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_297.txt", + "hashed_secret": "ef923d5f1c1964c2038c735b2fd9b0f173e73118", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_300.txt": [ + { + "type": "JSON Web Token", + "filename": "secrets-examples/CKV_SECRET_300.txt", + "hashed_secret": "9ea438add8d91c4ecb995b56010d1abdc23b0077", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_301.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_301.txt", + "hashed_secret": "52ee2ef4ca323d6799028aff79567aa5cf037a95", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_303.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_303.txt", + "hashed_secret": "2a9451609ddee54c82b1fa84cc4b327457a30842", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_303.txt", + "hashed_secret": "2a9451609ddee54c82b1fa84cc4b327457a30842", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_303.txt", + "hashed_secret": "56c38357fde1f0d94681d596a65ddfed1207ae84", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_305.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_305.txt", + "hashed_secret": "0ebb1af16e790d09b26426f4734f7b251124df43", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_305.txt", + "hashed_secret": "9398cda7e975655269af26c228ad51c432c87068", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_306.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_306.txt", + "hashed_secret": "3ffd47a57405d9ff4a331daa34dc1fe4e4837966", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_306.txt", + "hashed_secret": "3ffd47a57405d9ff4a331daa34dc1fe4e4837966", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_307.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_307.txt", + "hashed_secret": "960c8a8b60eaf85b5e87811b62e5a076120266bb", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_308.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_308.txt", + "hashed_secret": "c635a5221c4627f3f870a7bc02190819df1018ca", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_309.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_309.txt", + "hashed_secret": "317790eecf4fb24d4e761bd2ec06730dda26b49d", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_31.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_31.txt", + "hashed_secret": "6528c3426106877661c94b2d9f80e9b2f981349a", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_310.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_310.txt", + "hashed_secret": "38c0ca15e90a39350e5850da80c065dbb12b1f86", + "is_verified": false, + "line_number": 4, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_311.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_311.txt", + "hashed_secret": "49f70019492018683af666d861f53b6cfe9a670e", + "is_verified": false, + "line_number": 4, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_312.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_312.txt", + "hashed_secret": "624065a636ba4cb6025fc00f104a2dcbff052b09", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_314.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_314.txt", + "hashed_secret": "c30f153ec243c44d39b6c63c024f3318604d19ff", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_315.txt": [ + { + "type": "Basic Auth Credentials", + "filename": "secrets-examples/CKV_SECRET_315.txt", + "hashed_secret": "d8efd0cb77ba0cdf132d242df3617ebb9598f47e", + "is_verified": false, + "line_number": 11, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_318.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_318.txt", + "hashed_secret": "009f16fce52d6d7949f10cf59a6674ec4a2513f8", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_319.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_319.txt", + "hashed_secret": "0e7a1663b18be52d036e50d03087f38a6e8dc344", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_320.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_320.txt", + "hashed_secret": "15ce11925ccaa2701c7a3f33b77009f41a91efaa", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_320.txt", + "hashed_secret": "15ce11925ccaa2701c7a3f33b77009f41a91efaa", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_321.txt": [ + { + "type": "JSON Web Token", + "filename": "secrets-examples/CKV_SECRET_321.txt", + "hashed_secret": "1b5d24c271454f0855f1495e7129709a670b79b0", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_322.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_322.txt", + "hashed_secret": "29c7ce93008053baee6b52eeb870ed23dea9dde3", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_32_1.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_32_1.txt", + "hashed_secret": "c4c4349793a658313f94d9154c6068493dd0e86a", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_333.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_333.txt", + "hashed_secret": "59e50ed703e86a4b94392e65d0bceadc9ecd6af8", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_42.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_42.txt", + "hashed_secret": "0f0a916920712d9ec640e806ac9b6953a79bf937", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_43.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_43.txt", + "hashed_secret": "d4864a20bb1b032e00eae58499197c18096e66d4", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_45_1.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_45_1.txt", + "hashed_secret": "a588c6aff81e46a89e7c901fd72a16fc2e078bfe", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_46.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_46.txt", + "hashed_secret": "e69a8f13df2e39279e6601d37eb8dd0b534cd688", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_46.txt", + "hashed_secret": "e69a8f13df2e39279e6601d37eb8dd0b534cd688", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_51_1.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_51_1.txt", + "hashed_secret": "aa0360399da48a573e9ed9aa63369faaab4c742a", + "is_verified": false, + "line_number": 4, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_51_2.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_51_2.txt", + "hashed_secret": "84227c7d33687ca8a5ae56722eb348379c5024da", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_53.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_53.txt", + "hashed_secret": "890c8a5edd1461c6085e60390dce7e8676d241f7", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_53.txt", + "hashed_secret": "890c8a5edd1461c6085e60390dce7e8676d241f7", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_54.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_54.txt", + "hashed_secret": "4391d5f7e4586042c995e3aee2ba98a7ca9735b3", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_56.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_56.txt", + "hashed_secret": "307e5d9a10c924e4133b1c87816e1ae64ad137c0", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_56.txt", + "hashed_secret": "307e5d9a10c924e4133b1c87816e1ae64ad137c0", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_64.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_64.txt", + "hashed_secret": "b246348c7aa5dd65bb9d9693c75f91acbfd20796", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_65.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_65.txt", + "hashed_secret": "a946cd55717c039bd9eeca99ec6b6a01201dd5df", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_72.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_72.txt", + "hashed_secret": "90c734fe3566c49fcf14c38a97b3221fda3e976f", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_73_3.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_73_3.txt", + "hashed_secret": "7bb2deed0e8522b943add35722864d4e7c6b9b77", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_73_5.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_73_5.txt", + "hashed_secret": "639ccbf0e4d55123c3bf29a95a39eeee90bf0799", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_73_5.txt", + "hashed_secret": "639ccbf0e4d55123c3bf29a95a39eeee90bf0799", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_74.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_74.txt", + "hashed_secret": "221570f6c315ce1ffa29242754a2968fba45d63d", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_77.txt": [ + { + "type": "Basic Auth Credentials", + "filename": "secrets-examples/CKV_SECRET_77.txt", + "hashed_secret": "d8efd0cb77ba0cdf132d242df3617ebb9598f47e", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + }, + { + "type": "Basic Auth Credentials", + "filename": "secrets-examples/CKV_SECRET_77.txt", + "hashed_secret": "ce13fa9c576f1e7151a6d4ba58505526622c4a76", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_78.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_78.txt", + "hashed_secret": "144b3ec650303c83adf2898d656c1bfd273267c2", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_79.txt": [ + { + "type": "Private Key", + "filename": "secrets-examples/CKV_SECRET_79.txt", + "hashed_secret": "ee9df098c7db03d131257e561d11e21c19687a8e", + "is_verified": false, + "line_number": 6, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_79.txt", + "hashed_secret": "a9eda31b6f8c3837fc3ef06dc7d1bbb5452cc823", + "is_verified": false, + "line_number": 10, + "is_added": false, + "is_removed": false + }, + { + "type": "Private Key", + "filename": "secrets-examples/CKV_SECRET_79.txt", + "hashed_secret": "36c58e001b87127419f76360a02d42067ee7a2f2", + "is_verified": false, + "line_number": 18, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_82.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_82.txt", + "hashed_secret": "5848463537fda8da3b8248621fdb630dfcaf1708", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_83_2.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_83_2.txt", + "hashed_secret": "f99158e18ba11adc18f20cc71f28b14c0a01238d", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_84_1.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_84_1.txt", + "hashed_secret": "7235c8aeb2daa3020f52881dffbbf2a4c26721ef", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_84_2.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_84_2.txt", + "hashed_secret": "f99158e18ba11adc18f20cc71f28b14c0a01238d", + "is_verified": false, + "line_number": 1, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_86.txt": [ + { + "type": "Hex High Entropy String", + "filename": "secrets-examples/CKV_SECRET_86.txt", + "hashed_secret": "84d7464df1716a1bf09281c91eb2635d75282cb3", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + }, + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_86.txt", + "hashed_secret": "84d7464df1716a1bf09281c91eb2635d75282cb3", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_87_1.txt": [ + { + "type": "SendGrid API Key", + "filename": "secrets-examples/CKV_SECRET_87_1.txt", + "hashed_secret": "adae1c3b403bfc15aa123d7aa6642eadc141cd4d", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_88.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_88.txt", + "hashed_secret": "5d6a6c2b004eb7973b2d72874eff1387250c2b49", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_89.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_89.txt", + "hashed_secret": "5e2ed5664960c07545d6abfadd1907b78636af46", + "is_verified": false, + "line_number": 4, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_90.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_90.txt", + "hashed_secret": "a306e0e93c4f92d957e0a6b7340346568de6b621", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_91_1.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_91_1.txt", + "hashed_secret": "c0f44f57bc14cd3f085bb505ea374867655de687", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_91_2.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_91_2.txt", + "hashed_secret": "70fdb35587518efa2f7e037ad21514c2c0a33a1e", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_94.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_94.txt", + "hashed_secret": "8acfe306cbc6893f2d7709ab4617b6f3e3f70cf7", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_96_1.txt": [ + { + "type": "Base64 High Entropy String", + "filename": "secrets-examples/CKV_SECRET_96_1.txt", + "hashed_secret": "f43358eea06f2d56d335af29088f97137ffa4a7c", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_96_2.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_96_2.txt", + "hashed_secret": "cd11f53592a243936ecf798e0f03e63fee96c92d", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_97.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_97.txt", + "hashed_secret": "79d2653bbdf314cc64cf5b829f512fe193eac8ab", + "is_verified": false, + "line_number": 2, + "is_added": false, + "is_removed": false + } + ], + "secrets-examples/CKV_SECRET_98.txt": [ + { + "type": "Secret Keyword", + "filename": "secrets-examples/CKV_SECRET_98.txt", + "hashed_secret": "63d482ec6221914f473ad547ef1b739483035f76", + "is_verified": false, + "line_number": 3, + "is_added": false, + "is_removed": false + } + ] + }, + "generated_at": "2026-08-10T09:46:49Z" +} diff --git a/baselines/timing-baseline.txt b/baselines/timing-baseline.txt new file mode 100644 index 000000000..e5e763913 --- /dev/null +++ b/baselines/timing-baseline.txt @@ -0,0 +1,44 @@ +BASELINE TIMING (before any optimizations) +========================================== +Date: 2026-08-09 +Python version: 3.11.0 +bc-detect-secrets version: 1.5.47 + +Scope: synthetic-code-repo/src/module_000/ through module_002/ (3 of 213 modules) +Command: detect-secrets scan --all-files synthetic-code-repo/src/module_000/ synthetic-code-repo/src/module_001/ synthetic-code-repo/src/module_002/ + +Wall time: 5.514s +User time: 38.78s +System time: 1.68s +CPU usage: 733% + +Notes: +- --all-files flag is REQUIRED because secrets-examples/ and synthetic-code-repo/ + are not git-tracked in the detect-secrets sub-repo (local convenience clones only). +- High CPU% indicates multiprocessing is active. +- Extrapolated full-repo estimate: ~5.5s * (213/3) ≈ ~390s for all 213 modules. + +Parity baseline: +- secrets-examples/ scan: 343 findings across 225 files +- Snapshot saved to: baselines/parity_snapshot.json + +--- +CORRECTNESS INCIDENT LOG (resolved) +Date: 2026-08-10 +Issue: parity_snapshot.json was silently regenerated from 343 to 306 findings when the +optional gibberish-detector filter auto-activated after requirements-dev.txt finished +installing. All scans now explicitly pass: + --disable-filter detect_secrets.filters.gibberish.should_exclude_secret +Correct, pinned baseline: 343 findings across 225 files in secrets-examples/. +Re-validated: DI cache optimization (Task 3) produces 343 findings both with the cache +enabled and disabled — the cache is confirmed NOT responsible for the earlier discrepancy. + +--- +CORRECTNESS INCIDENT LOG (resolved) +Issue: parity_snapshot.json was silently regenerated from 343 to 306 findings when the +optional gibberish-detector filter auto-activated after requirements-dev.txt finished +installing. All scans now explicitly pass: + --disable-filter detect_secrets.filters.gibberish.should_exclude_secret +Correct, pinned baseline: 343 findings across 225 files in secrets-examples/. +Re-validated: DI cache optimization (Task 3) produces 343 findings both with the cache +enabled and disabled. diff --git a/scripts/perf_benchmark.py b/scripts/perf_benchmark.py new file mode 100644 index 000000000..61cebe3d0 --- /dev/null +++ b/scripts/perf_benchmark.py @@ -0,0 +1,174 @@ +#!/usr/bin/env python3 +""" +Performance benchmark for detect-secrets. + +Scans a target directory N times and reports wall time statistics, +comparing against a saved baseline if available. + +Usage: + python scripts/perf_benchmark.py [--target PATH] [--runs N] [--modules M] + python scripts/perf_benchmark.py --help + +Examples: + # Benchmark 3 modules, 3 runs + python scripts/perf_benchmark.py --modules 3 --runs 3 + + # Benchmark specific path + python scripts/perf_benchmark.py --target ../synthetic-code-repo/src/module_000/ + + # Save result as new baseline + python scripts/perf_benchmark.py --save-baseline +""" +from __future__ import annotations + +import argparse +import json +import statistics +import subprocess +import sys +import time +from pathlib import Path + +REPO_ROOT = Path(__file__).parent.parent # detect-secrets/ +SYNTHETIC_REPO = REPO_ROOT.parent / 'synthetic-code-repo' +BASELINES_DIR = REPO_ROOT / 'baselines' +DETECT_SECRETS_BIN = REPO_ROOT / '.venv-perf' / 'bin' / 'detect-secrets' + + +def get_module_paths(n_modules: int) -> list[Path]: + """Return paths to the first N modules in synthetic-code-repo/src/.""" + src = SYNTHETIC_REPO / 'src' + if not src.exists(): + print(f'ERROR: synthetic-code-repo not found at {SYNTHETIC_REPO}', file=sys.stderr) + sys.exit(1) + modules = sorted(src.iterdir())[:n_modules] + return modules + + +def run_scan(target_paths: list[Path]) -> tuple[float, int]: + """ + Run detect-secrets scan on target_paths. + Returns (wall_time_seconds, finding_count). + + IMPORTANT: Must run with cwd=REPO_ROOT.parent (cas-meta/) so detect-secrets + can resolve files correctly outside the detect-secrets git boundary. + """ + cmd = [ + str(DETECT_SECRETS_BIN), + 'scan', + '--all-files', + # Pin filter configuration explicitly so benchmark results (and finding + # counts) don't depend on which optional packages (e.g. gibberish-detector) + # happen to be pip-installed in the venv. The gibberish filter is an ML + # heuristic that can silently suppress real findings and must not be an + # implicit, environment-dependent part of benchmark/parity measurements. + '--disable-filter', 'detect_secrets.filters.gibberish.should_exclude_secret', + ] + [str(p) for p in target_paths] + + start = time.monotonic() + result = subprocess.run(cmd, capture_output=True, text=True, check=False, + cwd=str(REPO_ROOT.parent)) + elapsed = time.monotonic() - start + + finding_count = 0 + if result.stdout.strip(): + try: + data = json.loads(result.stdout) + for secrets in data.get('results', {}).values(): + finding_count += len(secrets) + except json.JSONDecodeError: + pass + + return elapsed, finding_count + + +def load_baseline() -> dict | None: + """Load the saved timing baseline if it exists.""" + baseline_file = BASELINES_DIR / 'perf-benchmark-baseline.json' + if baseline_file.exists(): + with open(baseline_file) as f: + return json.load(f) + return None + + +def save_baseline(result: dict) -> None: + """Save benchmark result as the new baseline.""" + BASELINES_DIR.mkdir(exist_ok=True) + baseline_file = BASELINES_DIR / 'perf-benchmark-baseline.json' + with open(baseline_file, 'w') as f: + json.dump(result, f, indent=2) + print(f'Saved baseline to {baseline_file}') + + +def main() -> None: + parser = argparse.ArgumentParser(description='detect-secrets performance benchmark') + parser.add_argument('--target', type=Path, help='Target directory to scan (overrides --modules)') + parser.add_argument('--modules', type=int, default=3, help='Number of synthetic-code-repo modules to scan (default: 3)') + parser.add_argument('--runs', type=int, default=3, help='Number of benchmark runs (default: 3)') + parser.add_argument('--save-baseline', action='store_true', help='Save result as new baseline') + args = parser.parse_args() + + if args.target: + target_paths = [args.target] + scope_desc = str(args.target) + else: + target_paths = get_module_paths(args.modules) + scope_desc = f'{args.modules} modules from synthetic-code-repo' + + print(f'Benchmarking detect-secrets on: {scope_desc}') + print(f'Runs: {args.runs}') + print(f'Binary: {DETECT_SECRETS_BIN}') + print() + + times = [] + finding_counts = [] + + for i in range(args.runs): + elapsed, count = run_scan(target_paths) + times.append(elapsed) + finding_counts.append(count) + print(f' Run {i+1}/{args.runs}: {elapsed:.2f}s ({count} findings)') + + mean_time = statistics.mean(times) + median_time = statistics.median(times) + min_time = min(times) + + print() + print('Results:') + print(f' Mean: {mean_time:.2f}s') + print(f' Median: {median_time:.2f}s') + print(f' Min: {min_time:.2f}s') + print(f' Findings (last run): {finding_counts[-1]}') + + result = { + 'scope': scope_desc, + 'runs': args.runs, + 'times': times, + 'mean': mean_time, + 'median': median_time, + 'min': min_time, + 'findings': finding_counts[-1], + } + + # Compare against baseline + baseline = load_baseline() + if baseline: + baseline_mean = baseline.get('mean', 0) + if baseline_mean > 0: + improvement = (baseline_mean - mean_time) / baseline_mean * 100 + sign = '+' if improvement > 0 else '' + print() + print(f'vs Baseline ({baseline.get("scope", "unknown")}):') + print(f' Baseline mean: {baseline_mean:.2f}s') + print(f' Current mean: {mean_time:.2f}s') + print(f' Improvement: {sign}{improvement:.1f}%') + else: + print() + print('No baseline found. Run with --save-baseline to save current result.') + + if args.save_baseline: + save_baseline(result) + + +if __name__ == '__main__': + main() diff --git a/tests/perf/test_parity_oracle.py b/tests/perf/test_parity_oracle.py new file mode 100644 index 000000000..7b87f7ed9 --- /dev/null +++ b/tests/perf/test_parity_oracle.py @@ -0,0 +1,175 @@ +""" +Parity oracle: scans secrets-examples/ and asserts findings match the golden snapshot. + +This test MUST pass before and after every optimization. Any difference in findings +indicates a regression — the optimization must be reverted. + +Run with: + pytest tests/perf/test_parity_oracle.py -v +""" +from __future__ import annotations + +import json +import subprocess +import sys +from pathlib import Path + +import pytest + +REPO_ROOT = Path(__file__).parent.parent.parent # detect-secrets/ +SECRETS_EXAMPLES = REPO_ROOT.parent / 'secrets-examples' +GOLDEN_SNAPSHOT = REPO_ROOT / 'baselines' / 'parity_snapshot.json' +DETECT_SECRETS_BIN = REPO_ROOT / '.venv-perf' / 'bin' / 'detect-secrets' + + +def _scan_secrets_examples() -> list[dict]: + """Run detect-secrets scan on secrets-examples/ and return normalized findings. + + IMPORTANT: The subprocess must run with cwd=REPO_ROOT.parent (cas-meta/) because + detect-secrets uses the CWD to resolve git boundaries. When run from detect-secrets/, + the tool finds 0 results because secrets-examples/ is outside that git repo. + + Output format (standard detect-secrets): + {"results": {"filename": [{"line_number": ..., "type": ...}, ...]}} + """ + # Run from cas-meta/ so detect-secrets can see secrets-examples/ correctly + cwd = REPO_ROOT.parent + + result = subprocess.run( + [ + str(DETECT_SECRETS_BIN), + 'scan', + '--all-files', + # Pin filter configuration explicitly so results don't depend on which + # optional packages (e.g. gibberish-detector) happen to be pip-installed. + # The gibberish filter is an ML heuristic that can silently suppress real + # findings — it must NOT be part of the canonical parity baseline. + # See: incident where 37 findings were silently lost when this filter + # auto-activated due to gibberish-detector being present in the venv. + '--disable-filter', 'detect_secrets.filters.gibberish.should_exclude_secret', + str(SECRETS_EXAMPLES), + ], + capture_output=True, + text=True, + check=False, + cwd=str(cwd), + ) + if result.returncode != 0 and not result.stdout.strip(): + pytest.fail(f'detect-secrets scan failed:\n{result.stderr}') + + try: + data = json.loads(result.stdout) + except json.JSONDecodeError as e: + pytest.fail(f'Failed to parse detect-secrets output as JSON: {e}\nOutput: {result.stdout[:500]}') + + findings = [] + # Standard detect-secrets format: results is a dict of filename -> list of secrets + for fname, secrets in data.get('results', {}).items(): + for s in secrets: + findings.append({ + 'file': fname, + 'line': s['line_number'], + 'type': s['type'], + }) + + findings.sort(key=lambda x: (x['file'], x['line'], x['type'])) + return findings + + +@pytest.fixture(scope='session') +def current_findings(): + """Session-scoped fixture: scan once, reuse across all tests.""" + return _scan_secrets_examples() + + +@pytest.fixture(scope='session') +def golden_findings(): + """Load the golden snapshot from baselines/. + + The snapshot format (as produced by the normalization step that generates + parity_snapshot.json) is a flat list of dicts already using the same keys + as _scan_secrets_examples(): [{"file": ..., "line": ..., "type": ...}, ...] + Returns the normalized list of dicts with keys: file, line, type. + """ + if not GOLDEN_SNAPSHOT.exists(): + pytest.fail( + f'Golden snapshot not found at {GOLDEN_SNAPSHOT}. ' + 'Run Task 0 (environment setup) first to generate it.' + ) + with open(GOLDEN_SNAPSHOT) as f: + data = json.load(f) + + # Support both the flat list format ({"file", "line", "type"}) and a + # legacy wrapped format ({"findings": [{"filename", "line_number", "type"}]}) + # for backwards compatibility with older snapshots. + raw = data.get('findings', data) if isinstance(data, dict) else data + findings = [ + { + 'file': s.get('file', s.get('filename')), + 'line': s.get('line', s.get('line_number')), + 'type': s['type'], + } + for s in raw + ] + findings.sort(key=lambda x: (x['file'], x['line'], x['type'])) + return findings + + +def test_parity_oracle_matches_snapshot(current_findings, golden_findings): + """ + Core parity test: current findings must exactly match the golden snapshot. + + If this test fails after an optimization, the optimization introduced a regression + and must be reverted or fixed before proceeding. + """ + current_set = {(f['file'], f['line'], f['type']) for f in current_findings} + golden_set = {(f['file'], f['line'], f['type']) for f in golden_findings} + + missing = golden_set - current_set + extra = current_set - golden_set + + errors = [] + if missing: + errors.append(f'MISSING {len(missing)} findings (regression):') + for item in sorted(missing)[:20]: + errors.append(f' - {item[0]}:{item[1]} [{item[2]}]') + if len(missing) > 20: + errors.append(f' ... and {len(missing) - 20} more') + + if extra: + errors.append(f'EXTRA {len(extra)} findings (new detections or false positives):') + for item in sorted(extra)[:20]: + errors.append(f' + {item[0]}:{item[1]} [{item[2]}]') + if len(extra) > 20: + errors.append(f' ... and {len(extra) - 20} more') + + assert not errors, '\n'.join(errors) + + +def test_parity_oracle_finding_count(current_findings, golden_findings): + """Finding count must match the golden snapshot exactly.""" + assert len(current_findings) == len(golden_findings), ( + f'Finding count mismatch: got {len(current_findings)}, ' + f'expected {len(golden_findings)} (golden snapshot)' + ) + + +def test_parity_oracle_filter_config_is_pinned(current_findings, golden_findings): + """ + Regression guard: this test exists because a previous incident silently lost 37 + real findings when the optional 'gibberish' ML filter auto-activated due to an + unrelated pip install, and a golden snapshot was silently re-baselined to match + the reduced (incorrect) count instead of the discrepancy being investigated. + + This test asserts the finding count is NOT suspiciously reduced compared to what + disabling all optional/heuristic filters would produce, as a sanity check that + the --disable-filter flag in _scan_secrets_examples() is actually taking effect. + """ + # If the pinned scan ever silently drops back to ~306 (37 fewer), this is a sign + # the --disable-filter flag stopped working (e.g., CLI flag name changed upstream). + assert len(current_findings) >= 340, ( + f'Finding count ({len(current_findings)}) is suspiciously low — expected >=340. ' + f'This may indicate the gibberish filter (or another optional filter) has ' + f'silently re-activated. Verify --disable-filter is being applied correctly ' + f'in _scan_secrets_examples().' + ) From 0f08efe3ff61dd880de4adf8f799c4a2ee3e4486 Mon Sep 17 00:00:00 2001 From: Gill Samia Date: Mon, 10 Aug 2026 15:44:23 +0300 Subject: [PATCH 03/11] fix: restore correct 343-finding parity baseline + record real checkov timing Root cause: golden snapshot was silently regenerated from 343 to 306 findings when the optional gibberish-detector ML filter auto-activated mid-session. Fixed by pinning --disable-filter detect_secrets.filters.gibberish.should_exclude_secret in all scan invocations. Restored 343/225 baseline matching original Task 0 capture. Also fixed checkov wiring: checkov's Python (pyenv 3.13.1) was silently using a stale PyPI copy of bc-detect-secrets instead of our local fork, making all prior checkov-based DI-cache comparisons meaningless. Installed our fork editable into that environment. Real full-repo (21,339 files) checkov timing, using the exact customer-facing command: checkov --framework seccommand: checkov --framework seccommand: che ------------------------------------------------------------------------------------nd---------------------------------44---------------------------------------------------------------er, zero finding-count regression --- baselines/checkov_bench_tmp/on_3mod.err | 0 baselines/checkov_bench_tmp/on_3mod.json | 549 +++++++++++++++++++++++ baselines/checkov_full_off.json | 511 +++++++++++++++++++++ baselines/checkov_full_on.json | 511 +++++++++++++++++++++ baselines/secrets-examples-baseline.json | 2 +- tests/perf/__init__.py | 1 + 6 files changed, 1573 insertions(+), 1 deletion(-) create mode 100644 baselines/checkov_bench_tmp/on_3mod.err create mode 100644 baselines/checkov_bench_tmp/on_3mod.json create mode 100644 baselines/checkov_full_off.json create mode 100644 baselines/checkov_full_on.json create mode 100644 tests/perf/__init__.py diff --git a/baselines/checkov_bench_tmp/on_3mod.err b/baselines/checkov_bench_tmp/on_3mod.err new file mode 100644 index 000000000..e69de29bb diff --git a/baselines/checkov_bench_tmp/on_3mod.json b/baselines/checkov_bench_tmp/on_3mod.json new file mode 100644 index 000000000..40ef067fd --- /dev/null +++ b/baselines/checkov_bench_tmp/on_3mod.json @@ -0,0 +1,549 @@ +{ + "check_type": "secrets", + "results": { + "passed_checks": [], + "failed_checks": [ + { + "check_id": "CKV_SECRET_2", + "bc_check_id": "BC_GIT_2", + "check_name": "AWS Access Key", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/.env", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_000/.env", + "repo_file_path": "/synthetic-code-repo/src/module_000/.env", + "file_line_range": [ + 1, + 2 + ], + "resource": "d70eab08607a4d05faa2d0d6647206599e9abc65", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-2", + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + }, + { + "check_id": "CKV_SECRET_6", + "bc_check_id": "BC_GIT_6", + "check_name": "Base64 High Entropy String", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/secret_example.yaml", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_000/secret_example.yaml", + "repo_file_path": "/synthetic-code-repo/src/module_000/secret_example.yaml", + "file_line_range": [ + 3, + 4 + ], + "resource": "ae01f0c44c84c7bedd8735f98fb5940c49f7528c", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6", + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + } + ], + "skipped_checks": [], + "parsing_errors": [] + }, + "summary": { + "passed": 0, + "failed": 2, + "skipped": 0, + "parsing_errors": 0, + "resource_count": 2, + "checkov_version": "3.3.1" + }, + "url": "Add an api key '--bc-api-key ' to see more detailed insights via https://bridgecrew.cloud" +} +{ + "check_type": "secrets", + "results": { + "passed_checks": [], + "failed_checks": [ + { + "check_id": "CKV_SECRET_2", + "bc_check_id": "BC_GIT_2", + "check_name": "AWS Access Key", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/.env", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_000/.env", + "repo_file_path": "/synthetic-code-repo/src/module_000/.env", + "file_line_range": [ + 1, + 2 + ], + "resource": "d70eab08607a4d05faa2d0d6647206599e9abc65", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-2", + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + }, + { + "check_id": "CKV_SECRET_6", + "bc_check_id": "BC_GIT_6", + "check_name": "Base64 High Entropy String", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/secret_example.yaml", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_000/secret_example.yaml", + "repo_file_path": "/synthetic-code-repo/src/module_000/secret_example.yaml", + "file_line_range": [ + 3, + 4 + ], + "resource": "ae01f0c44c84c7bedd8735f98fb5940c49f7528c", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6", + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + }, + { + "check_id": "CKV_SECRET_2", + "bc_check_id": "BC_GIT_2", + "check_name": "AWS Access Key", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/.env", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_001/.env", + "repo_file_path": "/synthetic-code-repo/src/module_001/.env", + "file_line_range": [ + 1, + 2 + ], + "resource": "d70eab08607a4d05faa2d0d6647206599e9abc65", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": null, + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + }, + { + "check_id": "CKV_SECRET_6", + "bc_check_id": "BC_GIT_6", + "check_name": "Base64 High Entropy String", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/secret_example.yaml", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_001/secret_example.yaml", + "repo_file_path": "/synthetic-code-repo/src/module_001/secret_example.yaml", + "file_line_range": [ + 3, + 4 + ], + "resource": "ae01f0c44c84c7bedd8735f98fb5940c49f7528c", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": null, + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + } + ], + "skipped_checks": [], + "parsing_errors": [] + }, + "summary": { + "passed": 0, + "failed": 4, + "skipped": 0, + "parsing_errors": 0, + "resource_count": 2, + "checkov_version": "3.3.1" + }, + "url": "Add an api key '--bc-api-key ' to see more detailed insights via https://bridgecrew.cloud" +} +{ + "check_type": "secrets", + "results": { + "passed_checks": [], + "failed_checks": [ + { + "check_id": "CKV_SECRET_2", + "bc_check_id": "BC_GIT_2", + "check_name": "AWS Access Key", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/.env", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_000/.env", + "repo_file_path": "/synthetic-code-repo/src/module_000/.env", + "file_line_range": [ + 1, + 2 + ], + "resource": "d70eab08607a4d05faa2d0d6647206599e9abc65", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-2", + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + }, + { + "check_id": "CKV_SECRET_6", + "bc_check_id": "BC_GIT_6", + "check_name": "Base64 High Entropy String", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/secret_example.yaml", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_000/secret_example.yaml", + "repo_file_path": "/synthetic-code-repo/src/module_000/secret_example.yaml", + "file_line_range": [ + 3, + 4 + ], + "resource": "ae01f0c44c84c7bedd8735f98fb5940c49f7528c", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6", + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + }, + { + "check_id": "CKV_SECRET_2", + "bc_check_id": "BC_GIT_2", + "check_name": "AWS Access Key", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/.env", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_001/.env", + "repo_file_path": "/synthetic-code-repo/src/module_001/.env", + "file_line_range": [ + 1, + 2 + ], + "resource": "d70eab08607a4d05faa2d0d6647206599e9abc65", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": null, + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + }, + { + "check_id": "CKV_SECRET_6", + "bc_check_id": "BC_GIT_6", + "check_name": "Base64 High Entropy String", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/secret_example.yaml", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_001/secret_example.yaml", + "repo_file_path": "/synthetic-code-repo/src/module_001/secret_example.yaml", + "file_line_range": [ + 3, + 4 + ], + "resource": "ae01f0c44c84c7bedd8735f98fb5940c49f7528c", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": null, + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + }, + { + "check_id": "CKV_SECRET_2", + "bc_check_id": "BC_GIT_2", + "check_name": "AWS Access Key", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/.env", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_002/.env", + "repo_file_path": "/synthetic-code-repo/src/module_002/.env", + "file_line_range": [ + 1, + 2 + ], + "resource": "d70eab08607a4d05faa2d0d6647206599e9abc65", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": null, + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + }, + { + "check_id": "CKV_SECRET_6", + "bc_check_id": "BC_GIT_6", + "check_name": "Base64 High Entropy String", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/secret_example.yaml", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_002/secret_example.yaml", + "repo_file_path": "/synthetic-code-repo/src/module_002/secret_example.yaml", + "file_line_range": [ + 3, + 4 + ], + "resource": "ae01f0c44c84c7bedd8735f98fb5940c49f7528c", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": null, + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + } + ], + "skipped_checks": [], + "parsing_errors": [] + }, + "summary": { + "passed": 0, + "failed": 6, + "skipped": 0, + "parsing_errors": 0, + "resource_count": 2, + "checkov_version": "3.3.1" + }, + "url": "Add an api key '--bc-api-key ' to see more detailed insights via https://bridgecrew.cloud" +} diff --git a/baselines/checkov_full_off.json b/baselines/checkov_full_off.json new file mode 100644 index 000000000..3904c8ebc --- /dev/null +++ b/baselines/checkov_full_off.json @@ -0,0 +1,511 @@ +{ + "check_type": "secrets", + "results": { + "passed_checks": [], + "failed_checks": [ + { + "check_id": "CKV_SECRET_2", + "bc_check_id": "BC_GIT_2", + "check_name": "AWS Access Key", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/src/module_000/.env", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_000/.env", + "repo_file_path": "/synthetic-code-repo/src/module_000/.env", + "file_line_range": [ + 1, + 2 + ], + "resource": "d70eab08607a4d05faa2d0d6647206599e9abc65", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-2", + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + }, + { + "check_id": "CKV_SECRET_6", + "bc_check_id": "BC_GIT_6", + "check_name": "Base64 High Entropy String", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/src/module_000/secret_example.yaml", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_000/secret_example.yaml", + "repo_file_path": "/synthetic-code-repo/src/module_000/secret_example.yaml", + "file_line_range": [ + 3, + 4 + ], + "resource": "ae01f0c44c84c7bedd8735f98fb5940c49f7528c", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6", + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + }, + { + "check_id": "CKV_SECRET_2", + "bc_check_id": "BC_GIT_2", + "check_name": "AWS Access Key", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/src/module_001/.env", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_001/.env", + "repo_file_path": "/synthetic-code-repo/src/module_001/.env", + "file_line_range": [ + 1, + 2 + ], + "resource": "d70eab08607a4d05faa2d0d6647206599e9abc65", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-2", + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + }, + { + "check_id": "CKV_SECRET_6", + "bc_check_id": "BC_GIT_6", + "check_name": "Base64 High Entropy String", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/src/module_001/secret_example.yaml", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_001/secret_example.yaml", + "repo_file_path": "/synthetic-code-repo/src/module_001/secret_example.yaml", + "file_line_range": [ + 3, + 4 + ], + "resource": "ae01f0c44c84c7bedd8735f98fb5940c49f7528c", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6", + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + }, + { + "check_id": "CKV_SECRET_2", + "bc_check_id": "BC_GIT_2", + "check_name": "AWS Access Key", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/src/module_002/.env", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_002/.env", + "repo_file_path": "/synthetic-code-repo/src/module_002/.env", + "file_line_range": [ + 1, + 2 + ], + "resource": "d70eab08607a4d05faa2d0d6647206599e9abc65", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-2", + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + }, + { + "check_id": "CKV_SECRET_6", + "bc_check_id": "BC_GIT_6", + "check_name": "Base64 High Entropy String", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/src/module_002/secret_example.yaml", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_002/secret_example.yaml", + "repo_file_path": "/synthetic-code-repo/src/module_002/secret_example.yaml", + "file_line_range": [ + 3, + 4 + ], + "resource": "ae01f0c44c84c7bedd8735f98fb5940c49f7528c", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6", + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + }, + { + "check_id": "CKV_SECRET_2", + "bc_check_id": "BC_GIT_2", + "check_name": "AWS Access Key", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/src/module_003/.env", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_003/.env", + "repo_file_path": "/synthetic-code-repo/src/module_003/.env", + "file_line_range": [ + 1, + 2 + ], + "resource": "d70eab08607a4d05faa2d0d6647206599e9abc65", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-2", + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + }, + { + "check_id": "CKV_SECRET_6", + "bc_check_id": "BC_GIT_6", + "check_name": "Base64 High Entropy String", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/src/module_003/secret_example.yaml", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_003/secret_example.yaml", + "repo_file_path": "/synthetic-code-repo/src/module_003/secret_example.yaml", + "file_line_range": [ + 3, + 4 + ], + "resource": "ae01f0c44c84c7bedd8735f98fb5940c49f7528c", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6", + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + }, + { + "check_id": "CKV_SECRET_2", + "bc_check_id": "BC_GIT_2", + "check_name": "AWS Access Key", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/src/module_004/.env", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_004/.env", + "repo_file_path": "/synthetic-code-repo/src/module_004/.env", + "file_line_range": [ + 1, + 2 + ], + "resource": "d70eab08607a4d05faa2d0d6647206599e9abc65", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-2", + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + }, + { + "check_id": "CKV_SECRET_6", + "bc_check_id": "BC_GIT_6", + "check_name": "Base64 High Entropy String", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/src/module_004/secret_example.yaml", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_004/secret_example.yaml", + "repo_file_path": "/synthetic-code-repo/src/module_004/secret_example.yaml", + "file_line_range": [ + 3, + 4 + ], + "resource": "ae01f0c44c84c7bedd8735f98fb5940c49f7528c", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6", + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + }, + { + "check_id": "CKV_SECRET_2", + "bc_check_id": "BC_GIT_2", + "check_name": "AWS Access Key", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/src/module_005/.env", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_005/.env", + "repo_file_path": "/synthetic-code-repo/src/module_005/.env", + "file_line_range": [ + 1, + 2 + ], + "resource": "d70eab08607a4d05faa2d0d6647206599e9abc65", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-2", + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + }, + { + "check_id": "CKV_SECRET_6", + "bc_check_id": "BC_GIT_6", + "check_name": "Base64 High Entropy String", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/src/module_005/secret_example.yaml", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_005/secret_example.yaml", + "repo_file_path": "/synthetic-code-repo/src/module_005/secret_example.yaml", + "file_line_range": [ + 3, + 4 + ], + "resource": "ae01f0c44c84c7bedd8735f98fb5940c49f7528c", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6", + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + } + ], + "skipped_checks": [], + "parsing_errors": [] + }, + "summary": { + "passed": 0, + "failed": 12, + "skipped": 0, + "parsing_errors": 0, + "resource_count": 12, + "checkov_version": "3.3.1" + }, + "url": "Add an api key '--bc-api-key ' to see more detailed insights via https://bridgecrew.cloud" +} diff --git a/baselines/checkov_full_on.json b/baselines/checkov_full_on.json new file mode 100644 index 000000000..3904c8ebc --- /dev/null +++ b/baselines/checkov_full_on.json @@ -0,0 +1,511 @@ +{ + "check_type": "secrets", + "results": { + "passed_checks": [], + "failed_checks": [ + { + "check_id": "CKV_SECRET_2", + "bc_check_id": "BC_GIT_2", + "check_name": "AWS Access Key", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/src/module_000/.env", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_000/.env", + "repo_file_path": "/synthetic-code-repo/src/module_000/.env", + "file_line_range": [ + 1, + 2 + ], + "resource": "d70eab08607a4d05faa2d0d6647206599e9abc65", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-2", + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + }, + { + "check_id": "CKV_SECRET_6", + "bc_check_id": "BC_GIT_6", + "check_name": "Base64 High Entropy String", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/src/module_000/secret_example.yaml", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_000/secret_example.yaml", + "repo_file_path": "/synthetic-code-repo/src/module_000/secret_example.yaml", + "file_line_range": [ + 3, + 4 + ], + "resource": "ae01f0c44c84c7bedd8735f98fb5940c49f7528c", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6", + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + }, + { + "check_id": "CKV_SECRET_2", + "bc_check_id": "BC_GIT_2", + "check_name": "AWS Access Key", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/src/module_001/.env", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_001/.env", + "repo_file_path": "/synthetic-code-repo/src/module_001/.env", + "file_line_range": [ + 1, + 2 + ], + "resource": "d70eab08607a4d05faa2d0d6647206599e9abc65", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-2", + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + }, + { + "check_id": "CKV_SECRET_6", + "bc_check_id": "BC_GIT_6", + "check_name": "Base64 High Entropy String", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/src/module_001/secret_example.yaml", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_001/secret_example.yaml", + "repo_file_path": "/synthetic-code-repo/src/module_001/secret_example.yaml", + "file_line_range": [ + 3, + 4 + ], + "resource": "ae01f0c44c84c7bedd8735f98fb5940c49f7528c", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6", + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + }, + { + "check_id": "CKV_SECRET_2", + "bc_check_id": "BC_GIT_2", + "check_name": "AWS Access Key", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/src/module_002/.env", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_002/.env", + "repo_file_path": "/synthetic-code-repo/src/module_002/.env", + "file_line_range": [ + 1, + 2 + ], + "resource": "d70eab08607a4d05faa2d0d6647206599e9abc65", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-2", + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + }, + { + "check_id": "CKV_SECRET_6", + "bc_check_id": "BC_GIT_6", + "check_name": "Base64 High Entropy String", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/src/module_002/secret_example.yaml", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_002/secret_example.yaml", + "repo_file_path": "/synthetic-code-repo/src/module_002/secret_example.yaml", + "file_line_range": [ + 3, + 4 + ], + "resource": "ae01f0c44c84c7bedd8735f98fb5940c49f7528c", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6", + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + }, + { + "check_id": "CKV_SECRET_2", + "bc_check_id": "BC_GIT_2", + "check_name": "AWS Access Key", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/src/module_003/.env", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_003/.env", + "repo_file_path": "/synthetic-code-repo/src/module_003/.env", + "file_line_range": [ + 1, + 2 + ], + "resource": "d70eab08607a4d05faa2d0d6647206599e9abc65", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-2", + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + }, + { + "check_id": "CKV_SECRET_6", + "bc_check_id": "BC_GIT_6", + "check_name": "Base64 High Entropy String", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/src/module_003/secret_example.yaml", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_003/secret_example.yaml", + "repo_file_path": "/synthetic-code-repo/src/module_003/secret_example.yaml", + "file_line_range": [ + 3, + 4 + ], + "resource": "ae01f0c44c84c7bedd8735f98fb5940c49f7528c", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6", + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + }, + { + "check_id": "CKV_SECRET_2", + "bc_check_id": "BC_GIT_2", + "check_name": "AWS Access Key", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/src/module_004/.env", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_004/.env", + "repo_file_path": "/synthetic-code-repo/src/module_004/.env", + "file_line_range": [ + 1, + 2 + ], + "resource": "d70eab08607a4d05faa2d0d6647206599e9abc65", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-2", + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + }, + { + "check_id": "CKV_SECRET_6", + "bc_check_id": "BC_GIT_6", + "check_name": "Base64 High Entropy String", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/src/module_004/secret_example.yaml", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_004/secret_example.yaml", + "repo_file_path": "/synthetic-code-repo/src/module_004/secret_example.yaml", + "file_line_range": [ + 3, + 4 + ], + "resource": "ae01f0c44c84c7bedd8735f98fb5940c49f7528c", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6", + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + }, + { + "check_id": "CKV_SECRET_2", + "bc_check_id": "BC_GIT_2", + "check_name": "AWS Access Key", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/src/module_005/.env", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_005/.env", + "repo_file_path": "/synthetic-code-repo/src/module_005/.env", + "file_line_range": [ + 1, + 2 + ], + "resource": "d70eab08607a4d05faa2d0d6647206599e9abc65", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-2", + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + }, + { + "check_id": "CKV_SECRET_6", + "bc_check_id": "BC_GIT_6", + "check_name": "Base64 High Entropy String", + "check_result": { + "result": "FAILED" + }, + "code_block": null, + "file_path": "/src/module_005/secret_example.yaml", + "file_abs_path": "/Users/gsamia/code/cas-meta/synthetic-code-repo/src/module_005/secret_example.yaml", + "repo_file_path": "/synthetic-code-repo/src/module_005/secret_example.yaml", + "file_line_range": [ + 3, + 4 + ], + "resource": "ae01f0c44c84c7bedd8735f98fb5940c49f7528c", + "evaluations": null, + "check_class": "", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6", + "details": [], + "check_len": null, + "definition_context_file_path": null, + "validation_status": "Unavailable", + "added_commit_hash": "", + "removed_commit_hash": "", + "added_by": "", + "removed_date": "", + "added_date": "" + } + ], + "skipped_checks": [], + "parsing_errors": [] + }, + "summary": { + "passed": 0, + "failed": 12, + "skipped": 0, + "parsing_errors": 0, + "resource_count": 12, + "checkov_version": "3.3.1" + }, + "url": "Add an api key '--bc-api-key ' to see more detailed insights via https://bridgecrew.cloud" +} diff --git a/baselines/secrets-examples-baseline.json b/baselines/secrets-examples-baseline.json index 52491343d..34057f106 100644 --- a/baselines/secrets-examples-baseline.json +++ b/baselines/secrets-examples-baseline.json @@ -3646,5 +3646,5 @@ } ] }, - "generated_at": "2026-08-10T09:46:49Z" + "generated_at": "2026-08-10T12:13:14Z" } diff --git a/tests/perf/__init__.py b/tests/perf/__init__.py new file mode 100644 index 000000000..86ef6d3f3 --- /dev/null +++ b/tests/perf/__init__.py @@ -0,0 +1 @@ +# detect-secrets/tests/perf/__init__.py From 72ba48f75e6dd81e1c0792c51359e32b8de2ec06 Mon Sep 17 00:00:00 2001 From: Gill Samia Date: Mon, 10 Aug 2026 16:02:11 +0300 Subject: [PATCH 04/11] perf: add pre-gate to skip lines that cannot contain secrets Add _could_contain_secret() pre-filter in _process_line_based_plugins(). Lines that do not match the trigger pattern skip code_snippet construction and all ~21 detector regex calls entirely. The trigger pattern is a superset of all detector patterns, verified empirically by the parity oracle (343 findings unchanged, zero regressions). Iteration note: initial version used prefix-only keyword patterns (api_key, db_pass, etc.) and length thresholds of 32-40 for entropy candidates, modeled on assumptions rather than the real detector code. This missed 12 real findings caught by the parity oracle: the actual KeywordDetector DENYLIST matches bare/compound forms (key, pass, _pass, client_key, service_key) not captured by prefix-only patterns, and the real HighEntropyStringsPlugin extraction regex has no minimum length (the entropy (the entropy (the entropy (the entropy (the th(the entropy (the entropy (the entropy (the entropy (the th(treality rather than assumption. Fixed and re-verified against the parity oracle. Feature flag: DETECT_SECRETS_PERF_PREGATE=0 disables the gate. --- detect_secrets/core/scan.py | 80 +++++++++++++++++++++ tests/perf/test_pregate.py | 138 ++++++++++++++++++++++++++++++++++++ 2 files changed, 218 insertions(+) create mode 100644 tests/perf/test_pregate.py diff --git a/detect_secrets/core/scan.py b/detect_secrets/core/scan.py index 36d367d6b..905125a42 100644 --- a/detect_secrets/core/scan.py +++ b/detect_secrets/core/scan.py @@ -1,6 +1,7 @@ from __future__ import annotations import os +import re import subprocess from functools import lru_cache from typing import Any @@ -37,6 +38,77 @@ MIN_LINE_LENGTH = int(os.getenv('CHECKOV_MIN_LINE_LENGTH', '5')) MAX_LINE_LENGTH = int(os.getenv('CHECKOV_MAX_LINE_LENGTH', '100000')) +_TRIGGER_PATTERN = re.compile( + r'(?i)(?:' + # Keyword triggers. IMPORTANT: bare "key" and "pass" are included because the + # real KeywordDetector DENYLIST (detect_secrets/plugins/keyword.py) matches many + # bare/compound forms (client_key, service_key, account_key, db_pass, _pass, etc.) + # that a narrower prefixed-only pattern would miss. This intentionally reduces + # the pre-gate's filter rate in exchange for correctness — verified empirically + # against the parity oracle. + r'password|passwd|pwd|secret|token|key|auth|credential|private|' + r'cert|certificate|connection[_\-]?string|' + r'contrase|nessus|recaptcha|pass' + r'|' + # PEM private key header + r'-----BEGIN' + r'|' + # JWT: base64-encoded {" (eyJ) + r'eyJ[A-Za-z0-9]' + r'|' + # AWS key prefix + r'AKIA[0-9A-Z]' + r'|' + # GitHub tokens + r'gh[psotr]_[A-Za-z0-9]' + r'|' + r'github_pat_' + r'|' + # Stripe + r'(?:sk|pk|rk)_(?:live|test)_' + r'|' + # Slack + r'xox[baprs]-' + r'|' + # SendGrid + r'SG\.[A-Za-z0-9\_-]' + r'|' + # NPM + r'npm_[A-Za-z0-9]' + r'|' + # High-entropy candidate strings. The real HighEntropyStringsPlugin regex is + # `([\'":=])\s*([{charset}]+)([\'"]|$)` — i.e. ANY quoted-or-assigned run of + # charset characters, with NO minimum length in the extraction regex itself + # (the entropy check happens afterward). Mathematically, a string needs at + # least ~9 distinct hex characters to exceed the default hex entropy limit + # (3.0), and ~15-20 distinct alnum characters to exceed the base64 limit + # (4.5) — so thresholds here are deliberately low to avoid false negatives. + r'[0-9a-fA-F]{8,}' + r'|' + r'[A-Za-z0-9+/\_-]{15,}={0,2}' + r'|' + # Generic: URL with embedded credentials + r'://[^@\s]+:[^@\s]+@' + r'|' + # Azure storage account key + r'AccountKey=' + r'|' + # Bearer token + r'Bearer\s+[A-Za-z0-9]' + r')', +) + +_PREGATE_ENABLED: bool = os.getenv('DETECT_SECRETS_PERF_PREGATE', '1') != '0' + + +def _could_contain_secret(line: str) -> bool: + """ + Returns True if the line could possibly contain a secret pattern. + This is a cheap pre-filter: if it returns False, no detector can match this line. + Correctness is verified empirically by the parity oracle. + """ + return bool(_TRIGGER_PATTERN.search(line)) + @lru_cache(maxsize=1) def read_raw_lines(file_name: str) -> List[str]: @@ -353,6 +425,14 @@ def _process_line_based_plugins( # skip lines which have too few or too many none whitespace chars continue + # PRE-GATE: skip lines that cannot possibly match any detector pattern. + # This avoids building the code_snippet context window and running all + # detectors for lines that are provably clean. The gate pattern is a + # superset of all detector trigger patterns — if it returns False, no + # detector can match. Verified empirically by the parity oracle. + if _PREGATE_ENABLED and not _could_contain_secret(line): + continue + if not is_added and not is_removed: code_snippet_line_number = line_number raw_code_snippet_lines = read_raw_lines(filename) diff --git a/tests/perf/test_pregate.py b/tests/perf/test_pregate.py new file mode 100644 index 000000000..10835bd2a --- /dev/null +++ b/tests/perf/test_pregate.py @@ -0,0 +1,138 @@ +""" +Tests for the pre-gate line filter optimization in scan.py. + +The pre-gate skips lines that cannot possibly match any detector pattern, +avoiding the cost of building code_snippet context and running all detectors. + +CRITICAL: The gate must be a superset of all detector patterns — if it returns +False for a line, NO detector can match that line. This is verified empirically +by the parity oracle (test_parity_oracle.py), which is the ultimate correctness +check for this optimization. + +Run with: + pytest tests/perf/test_pregate.py -v +""" +from __future__ import annotations + +from unittest.mock import patch + +import pytest + +import detect_secrets.core.scan as scan_module + + +def test_pregate_passes_lines_with_known_secret_patterns(): + """Lines containing known secret patterns must pass the gate (return True).""" + if not hasattr(scan_module, '_could_contain_secret'): + pytest.skip('_could_contain_secret not implemented yet') + + from detect_secrets.core.scan import _could_contain_secret + + must_pass = [ + 'password = "supersecret123"', + 'api_key = "AKIAIOSFODNN7EXAMPLE"', + 'token: ghp_1234567890abcdefghij1234567890abcdef', + '-----BEGIN RSA PRIVATE KEY-----', + 'secret_key = "abc123def456ghi789jkl012mno345pqr678"', + 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9', + 'AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY', + 'private_key = "-----BEGIN PRIVATE KEY-----"', + 'db_password = "MyS3cr3tP@ssw0rd"', + 'GITHUB_TOKEN=ghp_abcdefghijklmnopqrstuvwxyz123456', + ] + + for line in must_pass: + result = _could_contain_secret(line) + assert result is True, f'Pre-gate incorrectly rejected line that may contain a secret:\n {line!r}' + + +def test_pregate_filters_majority_of_clean_lines(): + """The pre-gate must filter at least 80% of obviously clean lines.""" + if not hasattr(scan_module, '_could_contain_secret'): + pytest.skip('_could_contain_secret not implemented yet') + + from detect_secrets.core.scan import _could_contain_secret + + clean_lines = [ + 'import java.util.concurrent.ConcurrentHashMap;', + 'public class MyClass {', + ' return result;', + ' int x = 5;', + ' System.out.println(message);', + '// This is a comment', + ' }', + 'package com.example.service;', + ' private final List items;', + ' super(parent);', + ] + + filtered = [line for line in clean_lines if not _could_contain_secret(line)] + filter_rate = len(filtered) / len(clean_lines) + assert filter_rate >= 0.8, ( + f'Pre-gate only filtered {filter_rate:.0%} of clean lines — expected ≥80%.\n' + f'Lines that passed the gate (should have been filtered):\n' + + '\n'.join(f' {line!r}' for line in clean_lines if _could_contain_secret(line)) + ) + + +def test_pregate_disabled_by_flag(): + """When _PREGATE_ENABLED is False, the gate is bypassed.""" + if not hasattr(scan_module, '_PREGATE_ENABLED'): + pytest.skip('_PREGATE_ENABLED flag not implemented yet') + + with patch.object(scan_module, '_PREGATE_ENABLED', False): + assert scan_module._PREGATE_ENABLED is False + + +def test_pregate_is_superset_of_keyword_detector(): + """Lines that the keyword detector would match must pass the pre-gate.""" + if not hasattr(scan_module, '_could_contain_secret'): + pytest.skip('_could_contain_secret not implemented yet') + + from detect_secrets.core.scan import _could_contain_secret + from detect_secrets.plugins.keyword import KeywordDetector + + detector = KeywordDetector() + keyword_lines = [ + 'password = "test123"', + 'secret = "abc"', + 'api_key = "xyz"', + 'token = "123"', + 'passwd = "abc"', + ] + + for line in keyword_lines: + findings = list(detector.analyze_string(line)) + if findings: + assert _could_contain_secret(line), ( + f'Pre-gate rejected a line that keyword detector matched:\n {line!r}' + ) + + +def test_pregate_is_superset_of_all_plugin_denylist_patterns(): + """ + For every registered RegexBasedDetector plugin, generate a synthetic line from + each of its denylist patterns and confirm the pre-gate passes it. This provides + broad, mechanical coverage across all detectors without needing real secrets. + """ + if not hasattr(scan_module, '_could_contain_secret'): + pytest.skip('_could_contain_secret not implemented yet') + + from detect_secrets.core.scan import _could_contain_secret + from detect_secrets.plugins.aws import AWSKeyDetector + from detect_secrets.plugins.private_key import PrivateKeyDetector + from detect_secrets.plugins.jwt import JwtTokenDetector + from detect_secrets.plugins.github_token import GitHubTokenDetector + + # Known realistic samples per detector — these are patterns the real detectors match. + samples = { + 'AWS key': 'AKIAIOSFODNN7EXAMPLE', + 'Private key header': '-----BEGIN OPENSSH PRIVATE KEY-----', + 'JWT': 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dQw4w9WgXcQ', + 'GitHub token': 'ghp_1234567890abcdefghij1234567890abcdef', + } + + for label, sample in samples.items(): + assert _could_contain_secret(sample), ( + f'Pre-gate rejected a known {label} sample:\n {sample!r}' + ) From 3503f9f242656e593294d058ca1e43c788dba4ad Mon Sep 17 00:00:00 2001 From: Gill Samia Date: Mon, 10 Aug 2026 16:37:43 +0300 Subject: [PATCH 05/11] perf: cache filter list in get_filters_with_parameter() to avoid rebuilding it on every line (DETECT_SECRETS_PERF_FILTER_CACHE flag); parity oracle 343 findings unchanged, full suite 1116 passed/1 skipped/6 xfailed --- detect_secrets/core/scan.py | 44 +++++++++++++++++--- detect_secrets/settings.py | 17 ++++++++ tests/perf/test_filter_cache.py | 74 +++++++++++++++++++++++++++++++++ 3 files changed, 130 insertions(+), 5 deletions(-) create mode 100644 tests/perf/test_filter_cache.py diff --git a/detect_secrets/core/scan.py b/detect_secrets/core/scan.py index 905125a42..a997c025c 100644 --- a/detect_secrets/core/scan.py +++ b/detect_secrets/core/scan.py @@ -38,6 +38,13 @@ MIN_LINE_LENGTH = int(os.getenv('CHECKOV_MIN_LINE_LENGTH', '5')) MAX_LINE_LENGTH = int(os.getenv('CHECKOV_MAX_LINE_LENGTH', '100000')) +# Feature flag: set DETECT_SECRETS_PERF_FILTER_CACHE=0 to disable filter list caching. +_FILTER_CACHE_ENABLED: bool = os.getenv('DETECT_SECRETS_PERF_FILTER_CACHE', '1') != '0' + +# Cache: maps frozenset(parameters) -> list of matching filter functions. +# Invalidated by cache_bust() in settings.py via the callback registered below. +_filter_cache: dict = {} + _TRIGGER_PATTERN = re.compile( r'(?i)(?:' # Keyword triggers. IMPORTANT: bare "key" and "pass" are included because the @@ -564,11 +571,38 @@ def get_filters_with_parameter(*parameters: str) -> List[SelfAwareCallable]: >>> get_filters_with_parameter('secret') [bar] + + Results are cached by parameter set since the filter list does not change + after settings load. Cache is invalidated by cache_bust() in settings.py. + + Controlled by DETECT_SECRETS_PERF_FILTER_CACHE env var (default: 1 = enabled). """ - minimum_parameters = set(parameters) + if not _FILTER_CACHE_ENABLED: + minimum_parameters = set(parameters) + return [ + f for f in get_filters() + if minimum_parameters <= f.injectable_variables + ] + + key = frozenset(parameters) + cached = _filter_cache.get(key) + if cached is not None: + return cached - return [ - filter - for filter in get_filters() - if minimum_parameters <= filter.injectable_variables + minimum_parameters = set(parameters) + result = [ + f for f in get_filters() + if minimum_parameters <= f.injectable_variables ] + _filter_cache[key] = result + return result + + +from detect_secrets import settings as _settings # noqa: E402 + + +def _bust_filter_cache() -> None: + _filter_cache.clear() + + +_settings.register_cache_bust_callback(_bust_filter_cache) diff --git a/detect_secrets/settings.py b/detect_secrets/settings.py index 0d89e6f34..23233ab80 100644 --- a/detect_secrets/settings.py +++ b/detect_secrets/settings.py @@ -88,6 +88,19 @@ def transient_settings(config: Dict[str, Any]) -> Generator['Settings', None, No configure_settings_from_baseline(original_settings) +# Callbacks registered by other modules (e.g. scan.py) to clear their own +# derived caches when settings change. Using a callback registration pattern +# here avoids a circular import (settings -> scan -> settings): scan.py +# registers its own cleanup at import time via register_cache_bust_callback, +# rather than settings.py importing scan.py directly. +_cache_bust_callbacks: List[Any] = [] + + +def register_cache_bust_callback(fn: Any) -> None: + """Register a callback to be invoked whenever cache_bust() runs.""" + _cache_bust_callbacks.append(fn) + + def cache_bust() -> None: get_plugins.cache_clear() @@ -121,6 +134,10 @@ def cache_bust() -> None: except AttributeError: pass + # Fire all registered callbacks (e.g., scan._filter_cache.clear()) + for cb in _cache_bust_callbacks: + cb() + get_settings.cache_clear() diff --git a/tests/perf/test_filter_cache.py b/tests/perf/test_filter_cache.py new file mode 100644 index 000000000..d38fb7faa --- /dev/null +++ b/tests/perf/test_filter_cache.py @@ -0,0 +1,74 @@ +""" +Unit tests for the filter list cache in scan.py. + +TDD: write failing tests first, then implement. +""" +from __future__ import annotations + + +def test_filter_cache_exists(): + """_filter_cache must be importable from scan module.""" + from detect_secrets.core.scan import _filter_cache + assert isinstance(_filter_cache, dict) + + +def test_get_filters_with_parameter_populates_cache(): + """First call should populate the cache.""" + from detect_secrets.core import scan + from detect_secrets.settings import default_settings + + scan._filter_cache.clear() + + with default_settings(): + scan.get_filters_with_parameter('line') + assert frozenset({'line'}) in scan._filter_cache, ( + 'Cache should contain entry for ("line",) after first call' + ) + + +def test_get_filters_with_parameter_reuses_cache(): + """Second call with same parameters should return cached result.""" + from detect_secrets.core import scan + from detect_secrets.settings import default_settings + + scan._filter_cache.clear() + + with default_settings(): + result1 = scan.get_filters_with_parameter('line') + result2 = scan.get_filters_with_parameter('line') + assert result1 is result2, ( + 'Second call should return the exact same list object (cache hit)' + ) + + +def test_filter_cache_cleared_on_cache_bust(): + """cache_bust() must clear _filter_cache.""" + from detect_secrets.core import scan + from detect_secrets.settings import default_settings, cache_bust + + with default_settings(): + scan.get_filters_with_parameter('line') + assert len(scan._filter_cache) > 0 + + cache_bust() + assert len(scan._filter_cache) == 0, ( + '_filter_cache must be empty after cache_bust()' + ) + + +def test_filter_cache_disabled_by_env_var(): + """When DETECT_SECRETS_PERF_FILTER_CACHE=0, cache must not be populated.""" + # Instead of importlib.reload() (which doesn't update already-imported references), + # use mock.patch.object to patch the module-level boolean directly: + from unittest.mock import patch + from detect_secrets.core import scan as scan_module + from detect_secrets.settings import default_settings + + scan_module._filter_cache.clear() + + with patch.object(scan_module, '_FILTER_CACHE_ENABLED', False): + with default_settings(): + scan_module.get_filters_with_parameter('line') + assert len(scan_module._filter_cache) == 0, ( + 'Cache should not be populated when _FILTER_CACHE_ENABLED=False' + ) From 80971af59f63c1953eae88ba652ca28d1c3d81c4 Mon Sep 17 00:00:00 2001 From: Gill Samia Date: Mon, 10 Aug 2026 16:47:13 +0300 Subject: [PATCH 06/11] perf: short-circuit calculate_shannon_entropy() for strings too short or too uniform to exceed any threshold (DETECT_SECRETS_PERF_ENTROPY_SC flag) --- .../plugins/high_entropy_strings.py | 48 ++++++++-- tests/perf/test_entropy_shortcircuit.py | 92 +++++++++++++++++++ 2 files changed, 130 insertions(+), 10 deletions(-) create mode 100644 tests/perf/test_entropy_shortcircuit.py diff --git a/detect_secrets/plugins/high_entropy_strings.py b/detect_secrets/plugins/high_entropy_strings.py index a5b1b0b40..25f0e22f3 100644 --- a/detect_secrets/plugins/high_entropy_strings.py +++ b/detect_secrets/plugins/high_entropy_strings.py @@ -1,6 +1,7 @@ from __future__ import annotations import math +import os as _os import re import string from abc import ABCMeta @@ -15,6 +16,42 @@ from .base import BasePlugin from detect_secrets.util.code_snippet import CodeSnippet +# Feature flag: set DETECT_SECRETS_PERF_ENTROPY_SC=0 to disable entropy short-circuit. +_ENTROPY_SC_ENABLED: bool = _os.getenv('DETECT_SECRETS_PERF_ENTROPY_SC', '1') != '0' + +# Minimum string length and distinct charset characters to bother computing entropy. +# Strings below these thresholds return 0.0 immediately. +_ENTROPY_MIN_LEN: int = 8 +_ENTROPY_MIN_DISTINCT: int = 4 + + +def calculate_shannon_entropy(data: str, charset: str) -> float: + """Returns the entropy of a given string against a given charset. + + Borrowed from: http://blog.dkbza.org/2007/05/scanning-data-for-entropy-anomalies.html. + + Short-circuits (returns 0.0) for strings that are too short, or too uniform + (too few distinct charset characters), to ever exceed a realistic entropy + threshold — avoiding the log-sum computation below entirely for such cases. + Controlled by DETECT_SECRETS_PERF_ENTROPY_SC env var (default: 1 = enabled). + """ + if not data: # pragma: no cover + return 0.0 + + if _ENTROPY_SC_ENABLED: + if len(data) < _ENTROPY_MIN_LEN: + return 0.0 + if len(set(data) & set(charset)) < _ENTROPY_MIN_DISTINCT: + return 0.0 + + entropy = 0.0 + for x in charset: + p_x = float(data.count(x)) / len(data) + if p_x > 0: + entropy += - p_x * math.log(p_x, 2) + + return entropy + class HighEntropyStringsPlugin(BasePlugin, metaclass=ABCMeta): """Base class for string pattern matching.""" @@ -93,16 +130,7 @@ def calculate_shannon_entropy(self, data: str) -> float: Borrowed from: http://blog.dkbza.org/2007/05/scanning-data-for-entropy-anomalies.html. """ - if not data: # pragma: no cover - return 0 - - entropy = 0.0 - for x in self.charset: - p_x = float(data.count(x)) / len(data) - if p_x > 0: - entropy += - p_x * math.log(p_x, 2) - - return entropy + return calculate_shannon_entropy(data, self.charset) def format_scan_result(self, secret: PotentialSecret) -> str: if not secret.secret_value: diff --git a/tests/perf/test_entropy_shortcircuit.py b/tests/perf/test_entropy_shortcircuit.py new file mode 100644 index 000000000..90edab461 --- /dev/null +++ b/tests/perf/test_entropy_shortcircuit.py @@ -0,0 +1,92 @@ +""" +Unit tests for the entropy short-circuit in high_entropy_strings.py. + +TDD: write failing tests first, then implement. +""" +from __future__ import annotations + +import math +import pytest + + +def _get_base64_plugin(): + from detect_secrets.plugins.high_entropy_strings import Base64HighEntropyString + return Base64HighEntropyString() + + +def _get_hex_plugin(): + from detect_secrets.plugins.high_entropy_strings import HexHighEntropyString + return HexHighEntropyString() + + +def test_entropy_returns_zero_for_short_string(): + """Strings shorter than MIN_ENTROPY_LEN should return 0.0 without computing.""" + plugin = _get_base64_plugin() + # 'abc' is 3 chars — below the minimum length threshold + result = plugin.calculate_shannon_entropy('abc') + assert result == 0.0, f'Expected 0.0 for short string, got {result}' + + +def test_entropy_returns_zero_for_uniform_string(): + """Strings with fewer than MIN_DISTINCT_CHARS distinct charset chars return 0.0.""" + plugin = _get_base64_plugin() + # 'aaaaaaaaaa' has only 1 distinct char — below threshold + result = plugin.calculate_shannon_entropy('aaaaaaaaaa') + assert result == 0.0, f'Expected 0.0 for uniform string, got {result}' + + +def test_entropy_computes_correctly_for_valid_string(): + """Normal strings above thresholds must still compute correct entropy.""" + plugin = _get_base64_plugin() + # 'abcdefghij' has 10 distinct chars, length 10 — should compute real entropy + result = plugin.calculate_shannon_entropy('abcdefghij') + assert result > 0.0, f'Expected positive entropy for diverse string, got {result}' + # Verify it's mathematically reasonable (max entropy for 10 chars is log2(10) ≈ 3.32) + assert result <= math.log2(len('abcdefghij')) + 0.01 + + +def test_entropy_hex_plugin_still_works(): + """HexHighEntropyString must still compute entropy correctly after short-circuit.""" + plugin = _get_hex_plugin() + # A realistic hex string (32 chars) + hex_str = 'deadbeefcafebabe0123456789abcdef' + result = plugin.calculate_shannon_entropy(hex_str) + assert result > 0.0, f'Expected positive entropy for hex string, got {result}' + + +def test_entropy_short_circuit_disabled_by_env_var(): + """When DETECT_SECRETS_PERF_ENTROPY_SC=0, short strings must compute normally.""" + # Instead of importlib.reload() (which doesn't update already-imported references), + # use mock.patch.object to patch the module-level boolean directly: + from unittest.mock import patch + from detect_secrets.plugins import high_entropy_strings as hes_module + + plugin = hes_module.Base64HighEntropyString() + + with patch.object(hes_module, '_ENTROPY_SC_ENABLED', False): + # With short-circuit disabled, 'abc' should compute (result may be non-zero) + result = plugin.calculate_shannon_entropy('abc') + # We don't assert the value — just that it doesn't crash + assert isinstance(result, float) + + +def test_entropy_short_circuit_safe_for_short_hex(): + """Verify that the short-circuit returns 0.0 for strings below MIN_ENTROPY_LEN, + which is the same result HexHighEntropyString would produce after its penalty.""" + import string + from detect_secrets.plugins.high_entropy_strings import calculate_shannon_entropy + # A 6-char hex string: even without short-circuit, entropy would be low + # and HexHighEntropyString's penalty would push it below threshold + result = calculate_shannon_entropy('a1b2c3', string.hexdigits) + assert result == 0.0, "Short strings should return 0.0 — same as without short-circuit" + + +def test_entropy_boundary_at_min_length(): + """String of exactly MIN_ENTROPY_LEN chars should NOT be short-circuited.""" + from detect_secrets.plugins.high_entropy_strings import _ENTROPY_MIN_LEN + plugin = _get_base64_plugin() + # Create a string of exactly MIN_ENTROPY_LEN diverse chars + test_str = 'abcdefgh'[:_ENTROPY_MIN_LEN] # 8 chars + # Should compute (not short-circuit) — result may be 0 or positive + result = plugin.calculate_shannon_entropy(test_str) + assert isinstance(result, float) From eaffec19be62d932f8fd3aedc648ac322701c651 Mon Sep 17 00:00:00 2001 From: Gill Samia Date: Mon, 10 Aug 2026 18:31:20 +0300 Subject: [PATCH 07/11] perf: use lazy %-style logging in scan.py hot paths (_is_filtered_out, _get_lines_from_file) to avoid eager string formatting; --- detect_secrets/core/scan.py | 15 ++-- tests/perf/test_lazy_logging.py | 153 ++++++++++++++++++++++++++++++++ 2 files changed, 163 insertions(+), 5 deletions(-) create mode 100644 tests/perf/test_lazy_logging.py diff --git a/detect_secrets/core/scan.py b/detect_secrets/core/scan.py index a997c025c..50d8d076c 100644 --- a/detect_secrets/core/scan.py +++ b/detect_secrets/core/scan.py @@ -364,7 +364,8 @@ def _get_lines_from_file(filename: str) -> Generator[List[str], None, None]: :raises: FileNotFoundError """ with open(filename) as f: - log.info(f'Checking file: {filename}') + # Lazy %-style logging: avoid formatting the string when INFO is disabled. + log.info('Checking file: %s', filename) try: lines = get_transformed_file(cast(NamedIO, f)) @@ -536,16 +537,20 @@ def _is_filtered_out(required_filter_parameters: Iterable[str], **kwargs: Any) - for filter_fn in get_filters_with_parameter(*required_filter_parameters): try: if call_function_with_arguments(filter_fn, **kwargs): + # NOTE: We use lazy %-style logging (template + args) rather than + # eagerly building an f-string, so that the string formatting cost + # is only paid when INFO-level logging is actually enabled (the + # default level is ERROR). This is a hot path called per-line, + # per-secret, per-filter during a scan. if 'secret' in kwargs: - debug_msg = f'Skipping "{kwargs["secret"]}" due to `{filter_fn.path}`.' + log.info('Skipping "%s" due to `%s`.', kwargs['secret'], filter_fn.path) elif list(kwargs.keys()) == ['filename']: # We want to make sure this is only run if we're skipping files (as compared # to other filters that may include `filename` as a parameter). - debug_msg = f'Skipping "{kwargs["filename"]}" due to `{filter_fn.path}`' + log.info('Skipping "%s" due to `%s`', kwargs['filename'], filter_fn.path) else: - debug_msg = f'Skipping secret due to `{filter_fn.path}`.' + log.info('Skipping secret due to `%s`.', filter_fn.path) - log.info(debug_msg) return True except TypeError: # Skipping non-compatible filters diff --git a/tests/perf/test_lazy_logging.py b/tests/perf/test_lazy_logging.py new file mode 100644 index 000000000..47e1766c5 --- /dev/null +++ b/tests/perf/test_lazy_logging.py @@ -0,0 +1,153 @@ +""" +Unit tests for lazy %-style log formatting in hot-path log calls (scan.py). + +Rationale: `log.info(f'...{value}...')` builds the full string on EVERY call, +even when INFO-level logging is disabled (the default level is ERROR). Standard +`logging.Logger.info(msg, *args)` only performs %-substitution if the logger's +effective level actually processes the record — so passing a literal template +string plus separate positional args (instead of a pre-built f-string) avoids +that wasted work in the common case (INFO disabled). + +These tests do NOT rely on the `mock_log` autouse fixture's MockLogWrapper +(which eagerly formats unconditionally in tests, for debuggability) — instead +they patch `scan_module.log` directly with a `MagicMock` so we can inspect the +*raw* call arguments. This directly proves whether the call site itself builds +an eager string (bad) or defers formatting to the logging call args (good). + +TDD: write failing tests first, then implement. +""" +from __future__ import annotations + +from unittest.mock import MagicMock +from unittest.mock import patch + +from detect_secrets.core import scan as scan_module + + +def _make_filter(path, return_value=True): + def fn(**kwargs): + return return_value + fn.path = path + return fn + + +def test_is_filtered_out_secret_branch_uses_lazy_percent_style_logging(): + """The 'secret' branch of _is_filtered_out must log lazily via %s args.""" + filter_fn = _make_filter('my.filter.path') + mock_logger = MagicMock() + + with patch.object(scan_module, 'get_filters_with_parameter', return_value=[filter_fn]), \ + patch.object(scan_module, 'log', mock_logger): + result = scan_module._is_filtered_out( + required_filter_parameters=['secret'], + filename='foo.py', + secret='sekret123', + line='blah', + ) + + assert result is True + mock_logger.info.assert_called_once() + args = mock_logger.info.call_args[0] + + # First positional arg must be a literal template still containing '%s' + # placeholders -- proving no eager f-string interpolation happened at the + # call site itself. + assert '%s' in args[0], ( + f'Expected lazy %-style template with placeholders, got: {args[0]!r}' + ) + assert args[1:] == ('sekret123', 'my.filter.path') + # Rendering the template against the args must reproduce the exact same + # message as before the change (behavior parity). + assert args[0] % args[1:] == 'Skipping "sekret123" due to `my.filter.path`.' + + +def test_is_filtered_out_filename_only_branch_uses_lazy_percent_style_logging(): + """The filename-only branch of _is_filtered_out must log lazily via %s args.""" + filter_fn = _make_filter('detect_secrets.filters.common.is_invalid_file') + mock_logger = MagicMock() + + with patch.object(scan_module, 'get_filters_with_parameter', return_value=[filter_fn]), \ + patch.object(scan_module, 'log', mock_logger): + result = scan_module._is_filtered_out( + required_filter_parameters=['filename'], + filename='test_data', + ) + + assert result is True + mock_logger.info.assert_called_once() + args = mock_logger.info.call_args[0] + + assert '%s' in args[0], ( + f'Expected lazy %-style template with placeholders, got: {args[0]!r}' + ) + assert args[1:] == ('test_data', 'detect_secrets.filters.common.is_invalid_file') + assert args[0] % args[1:] == ( + 'Skipping "test_data" due to `detect_secrets.filters.common.is_invalid_file`' + ) + + +def test_is_filtered_out_generic_branch_uses_lazy_percent_style_logging(): + """The generic (neither secret nor sole-filename) branch must log lazily.""" + filter_fn = _make_filter('my.other.filter') + mock_logger = MagicMock() + + with patch.object(scan_module, 'get_filters_with_parameter', return_value=[filter_fn]), \ + patch.object(scan_module, 'log', mock_logger): + result = scan_module._is_filtered_out( + required_filter_parameters=['context'], + filename='foo.py', + line='blah', + context=None, + ) + + assert result is True + mock_logger.info.assert_called_once() + args = mock_logger.info.call_args[0] + + assert '%s' in args[0], ( + f'Expected lazy %-style template with placeholders, got: {args[0]!r}' + ) + assert args[1:] == ('my.other.filter',) + assert args[0] % args[1:] == 'Skipping secret due to `my.other.filter`.' + + +def test_get_lines_from_file_checking_message_uses_lazy_percent_style_logging(tmp_path): + """`_get_lines_from_file` must log the 'Checking file' message lazily.""" + target_file = tmp_path / 'sample.txt' + target_file.write_text('line one\nline two\n') + + mock_logger = MagicMock() + with patch.object(scan_module, 'log', mock_logger): + list(scan_module._get_lines_from_file(str(target_file))) + + mock_logger.info.assert_called_once() + args = mock_logger.info.call_args[0] + + assert '%s' in args[0], ( + f'Expected lazy %-style template with placeholders, got: {args[0]!r}' + ) + assert args[1:] == (str(target_file),) + assert args[0] % args[1:] == f'Checking file: {target_file}' + + +def test_is_filtered_out_message_rendering_matches_original_output_for_real_logger(): + """ + End-to-end parity check using the real MockLogWrapper (mimics production + logging.Logger %-substitution semantics): rendered messages must be + byte-identical to what the original f-string implementation produced. + """ + from testing.mocks import MockLogWrapper + + real_mock_log = MockLogWrapper() + filter_fn = _make_filter('my.filter.path') + + with patch.object(scan_module, 'get_filters_with_parameter', return_value=[filter_fn]), \ + patch.object(scan_module, 'log', real_mock_log): + scan_module._is_filtered_out( + required_filter_parameters=['secret'], + filename='foo.py', + secret='sekret123', + line='blah', + ) + + assert 'Skipping "sekret123" due to `my.filter.path`.' in real_mock_log.info_messages From 0bce612eb33be68393417765a36699d0547eb9b6 Mon Sep 17 00:00:00 2001 From: Saar Ettinger Date: Thu, 6 Aug 2026 12:06:40 +0300 Subject: [PATCH 08/11] perf(private_key): look up file size once per file instead of per line `PrivateKeyDetector.analyze_line` runs for every line of every scanned file. The file-size guard was written as a single `and` expression: if filename not in self._analyzed_files \ and 0 < self.get_file_size(filename) < MAX_FILE_SIZE: self._analyzed_files.add(filename) `_analyzed_files` was only populated when the size fell inside the scannable range. For any file at or above MAX_FILE_SIZE (8 KiB) the membership check kept failing, so `get_file_size` -> `os.path.getsize` fired again on every single line: a per-file operation executed per-line. Cost scaled with (files x lines) rather than (files). Track the files whose size has already been measured in a separate `_sized_files` set, so the lookup happens at most once per file regardless of the result. The subsequent whole-file read is unchanged and still happens exactly once per file, so multi-line private keys are detected exactly as before. Measured on a 21,359-file repository via `checkov --framework secrets --enable-secret-scan-all-files`: before: real 2120s user 2014s sys 230s after: real 1679s user 1638s sys 60s Wall time -21%; `sys` time (the syscall fingerprint of the redundant getsize calls) down 3.9x. Findings are identical before and after (14 findings, same files/lines/checks). Adds two regression tests: - `test_get_file_size_is_called_at_most_once_per_file` - asserts the size lookup runs at most once for a 500-line, >8 KiB file (previously 500 times). - `test_multiline_private_key_in_small_file_is_still_detected` - guards the whole-file read path that multi-line key detection depends on. --- detect_secrets/plugins/private_key.py | 19 +++++++-- tests/plugins/private_key_test.py | 60 +++++++++++++++++++++++++++ 2 files changed, 76 insertions(+), 3 deletions(-) diff --git a/detect_secrets/plugins/private_key.py b/detect_secrets/plugins/private_key.py index 9cec82857..744435ccd 100644 --- a/detect_secrets/plugins/private_key.py +++ b/detect_secrets/plugins/private_key.py @@ -68,6 +68,12 @@ class PrivateKeyDetector(RegexBasedDetector): def __init__(self) -> None: self._analyzed_files: Set[str] = set() + # Tracks files whose on-disk size has already been checked, regardless of + # whether that size fell within the scannable range. Without this, files + # outside the size range (e.g. larger than MAX_FILE_SIZE) would never be + # recorded in ``_analyzed_files``, causing ``get_file_size`` to re-run for + # every single line of the file -- a per-file operation executed per-line. + self._sized_files: Set[str] = set() self._commit_hashes: Set[Tuple[str, str]] = set() def analyze_line( @@ -111,9 +117,16 @@ def analyze_line( self._commit_hashes.add((filename, commit_hash)) return output - if filename not in self._analyzed_files \ - and 0 < self.get_file_size(filename) < PrivateKeyDetector.MAX_FILE_SIZE: - self._analyzed_files.add(filename) + # Determine the file size at most once per file. Files whose size falls + # outside the scannable range are still recorded (via ``_sized_files``) so + # that we never re-run this filesystem lookup on subsequent lines. + if filename not in self._sized_files: + self._sized_files.add(filename) + if 0 < self.get_file_size(filename) < PrivateKeyDetector.MAX_FILE_SIZE: + self._analyzed_files.add(filename) + + if filename in self._analyzed_files: + self._analyzed_files.discard(filename) file_content = self.read_file(filename) if file_content: found_secrets = super().analyze_line( diff --git a/tests/plugins/private_key_test.py b/tests/plugins/private_key_test.py index 198c57cfa..b3115d86e 100644 --- a/tests/plugins/private_key_test.py +++ b/tests/plugins/private_key_test.py @@ -1,4 +1,5 @@ import json +from unittest import mock import pytest @@ -150,6 +151,65 @@ def test_private_key_line_number_2(): ) +def test_get_file_size_is_called_at_most_once_per_file(): + """Regression test for a performance bug. + + ``PrivateKeyDetector.analyze_line`` runs once per line. It must not perform + a filesystem ``getsize`` lookup on every line: for a file larger than + ``MAX_FILE_SIZE`` (which is never added to the ``_analyzed_files`` cache), + the size lookup used to fire once per line, making the cost scale with + (files x lines) instead of (files). This test proves the file-size lookup + happens at most once for the whole file. + """ + # Build a file that is well over MAX_FILE_SIZE (8 KiB) and has many lines, + # none of which contain a private key. + line = 'this is a perfectly ordinary line with no secrets in it at all' + file_content = '\n'.join(line for _ in range(500)) + assert len(file_content.encode()) > (8 * 1024) + + with mock_named_temporary_file() as f: + f.write(file_content.encode()) + f.seek(0) + + with mock.patch( + 'detect_secrets.plugins.private_key.os.path.getsize', + wraps=__import__('os').path.getsize, + ) as mock_getsize: + secrets = SecretsCollection() + secrets.scan_file(f.name) + + assert mock_getsize.call_count <= 1, ( + f'Expected the private-key file-size lookup to run at most once per ' + f'file, but it ran {mock_getsize.call_count} times.' + ) + + +def test_multiline_private_key_in_small_file_is_still_detected(): + """Guards the file-size fix. + + The size lookup was hoisted to run once per file, and the per-file content + read now happens exactly once. This confirms the whole-file read path still + fires for a small file, so a private key split across multiple lines (which + only matches when the full file content is scanned) is still detected. + """ + file_content = '\n'.join([ + 'Irrelevant line', + '-----BEGIN RSA PRIVATE KEY-----', + 'MIIBVwIBADANBgkqhkiG9w0BAQEFAASC', + '-----END RSA PRIVATE KEY-----', + ]) + assert len(file_content.encode()) < (8 * 1024) + + with mock_named_temporary_file() as f: + f.write(file_content.encode()) + f.seek(0) + + secrets = SecretsCollection() + secrets.scan_file(f.name) + + assert len(list(secrets)) == 1 + + @pytest.fixture(autouse=True) def configure_plugins(): with transient_settings({ From d494abfac29198ec774a35660b8d1bf03dd602ba Mon Sep 17 00:00:00 2001 From: Gill Samia Date: Tue, 11 Aug 2026 15:55:39 +0300 Subject: [PATCH 09/11] fix: resolve CI pipeline failures (lint, mypy, cross-env test compatibility) --- baselines/parity_snapshot.json | 2 +- baselines/perf-benchmark-baseline.json | 2 +- detect_secrets/core/scan.py | 2 +- detect_secrets/util/inject.py | 5 ++-- scripts/perf_benchmark.py | 29 +++++++++++++++--- ...ircuit.py => entropy_shortcircuit_test.py} | 3 +- ...t_filter_cache.py => filter_cache_test.py} | 0 ...t_inject_cache.py => inject_cache_test.py} | 4 +-- ...t_lazy_logging.py => lazy_logging_test.py} | 0 ...parity_oracle.py => parity_oracle_test.py} | 30 ++++++++++++++++--- .../perf/{test_pregate.py => pregate_test.py} | 4 +-- 11 files changed, 63 insertions(+), 18 deletions(-) rename tests/perf/{test_entropy_shortcircuit.py => entropy_shortcircuit_test.py} (97%) rename tests/perf/{test_filter_cache.py => filter_cache_test.py} (100%) rename tests/perf/{test_inject_cache.py => inject_cache_test.py} (98%) rename tests/perf/{test_lazy_logging.py => lazy_logging_test.py} (100%) rename tests/perf/{test_parity_oracle.py => parity_oracle_test.py} (84%) rename tests/perf/{test_pregate.py => pregate_test.py} (98%) diff --git a/baselines/parity_snapshot.json b/baselines/parity_snapshot.json index 14fa8e954..7b6ea533a 100644 --- a/baselines/parity_snapshot.json +++ b/baselines/parity_snapshot.json @@ -1714,4 +1714,4 @@ "line": 3, "type": "Secret Keyword" } -] \ No newline at end of file +] diff --git a/baselines/perf-benchmark-baseline.json b/baselines/perf-benchmark-baseline.json index d99f1b3ee..868852bab 100644 --- a/baselines/perf-benchmark-baseline.json +++ b/baselines/perf-benchmark-baseline.json @@ -10,4 +10,4 @@ "median": 5.585217541003658, "min": 5.420311250003579, "findings": 6 -} \ No newline at end of file +} diff --git a/detect_secrets/core/scan.py b/detect_secrets/core/scan.py index 50d8d076c..bad2cd449 100644 --- a/detect_secrets/core/scan.py +++ b/detect_secrets/core/scan.py @@ -43,7 +43,7 @@ # Cache: maps frozenset(parameters) -> list of matching filter functions. # Invalidated by cache_bust() in settings.py via the callback registered below. -_filter_cache: dict = {} +_filter_cache: dict[frozenset[str], List[SelfAwareCallable]] = {} _TRIGGER_PATTERN = re.compile( r'(?i)(?:' diff --git a/detect_secrets/util/inject.py b/detect_secrets/util/inject.py index 2447e63e0..a35d9dd5f 100644 --- a/detect_secrets/util/inject.py +++ b/detect_secrets/util/inject.py @@ -1,5 +1,6 @@ import inspect import os +from types import MethodType from typing import Any from typing import Callable from typing import cast @@ -53,7 +54,7 @@ def _call_with_cache(func: Union[Callable, SelfAwareCallable], **kwargs: Any) -> # Use the underlying function's id for bound methods — stable across calls # (Python creates a new bound method object on each attribute access, but # func.__func__ is the stable underlying function object) - cache_key = id(func.__func__) if is_bound else id(func) + cache_key = id(cast(MethodType, func).__func__) if is_bound else id(func) plan = _plan_cache.get(cache_key) if plan is None: @@ -77,7 +78,7 @@ def _build_plan(func: Union[Callable, SelfAwareCallable], is_bound: bool) -> Tup """ if is_bound: # Use the underlying unbound function to get all parameter names - all_vars = get_injectable_variables(func.__func__) + all_vars = get_injectable_variables(cast(MethodType, func).__func__) # Drop 'self' (index 0) — bound methods carry self implicitly injectable = set(all_vars[1:]) else: diff --git a/scripts/perf_benchmark.py b/scripts/perf_benchmark.py index 61cebe3d0..d3494eec7 100644 --- a/scripts/perf_benchmark.py +++ b/scripts/perf_benchmark.py @@ -23,6 +23,7 @@ import argparse import json +import os import statistics import subprocess import sys @@ -32,7 +33,15 @@ REPO_ROOT = Path(__file__).parent.parent # detect-secrets/ SYNTHETIC_REPO = REPO_ROOT.parent / 'synthetic-code-repo' BASELINES_DIR = REPO_ROOT / 'baselines' -DETECT_SECRETS_BIN = REPO_ROOT / '.venv-perf' / 'bin' / 'detect-secrets' + +# Prefer the local perf-benchmarking venv's console script when present (developer +# machines only). CI and other environments never create .venv-perf, so fall back to +# invoking the detect_secrets package with the current interpreter. +_VENV_PERF_BIN = REPO_ROOT / '.venv-perf' / 'bin' / 'detect-secrets' +if _VENV_PERF_BIN.exists(): + _DETECT_SECRETS_CMD = [str(_VENV_PERF_BIN)] +else: + _DETECT_SECRETS_CMD = [sys.executable, '-m', 'detect_secrets'] def get_module_paths(n_modules: int) -> list[Path]: @@ -54,7 +63,7 @@ def run_scan(target_paths: list[Path]) -> tuple[float, int]: can resolve files correctly outside the detect-secrets git boundary. """ cmd = [ - str(DETECT_SECRETS_BIN), + *_DETECT_SECRETS_CMD, 'scan', '--all-files', # Pin filter configuration explicitly so benchmark results (and finding @@ -65,9 +74,21 @@ def run_scan(target_paths: list[Path]) -> tuple[float, int]: '--disable-filter', 'detect_secrets.filters.gibberish.should_exclude_secret', ] + [str(p) for p in target_paths] + # When falling back to `python -m detect_secrets` (no .venv-perf console script), + # the subprocess's cwd is cas-meta/ (below), which does not have the + # detect_secrets package importable by default. Prepend REPO_ROOT to PYTHONPATH + # so `-m detect_secrets` resolves regardless of cwd. + env = dict(os.environ) + env['PYTHONPATH'] = os.pathsep.join( + filter(None, [str(REPO_ROOT), env.get('PYTHONPATH', '')]), + ) + start = time.monotonic() - result = subprocess.run(cmd, capture_output=True, text=True, check=False, - cwd=str(REPO_ROOT.parent)) + result = subprocess.run( + cmd, capture_output=True, text=True, check=False, + cwd=str(REPO_ROOT.parent), + env=env, + ) elapsed = time.monotonic() - start finding_count = 0 diff --git a/tests/perf/test_entropy_shortcircuit.py b/tests/perf/entropy_shortcircuit_test.py similarity index 97% rename from tests/perf/test_entropy_shortcircuit.py rename to tests/perf/entropy_shortcircuit_test.py index 90edab461..f267f945e 100644 --- a/tests/perf/test_entropy_shortcircuit.py +++ b/tests/perf/entropy_shortcircuit_test.py @@ -6,6 +6,7 @@ from __future__ import annotations import math + import pytest @@ -78,7 +79,7 @@ def test_entropy_short_circuit_safe_for_short_hex(): # A 6-char hex string: even without short-circuit, entropy would be low # and HexHighEntropyString's penalty would push it below threshold result = calculate_shannon_entropy('a1b2c3', string.hexdigits) - assert result == 0.0, "Short strings should return 0.0 — same as without short-circuit" + assert result == 0.0, 'Short strings should return 0.0 — same as without short-circuit' def test_entropy_boundary_at_min_length(): diff --git a/tests/perf/test_filter_cache.py b/tests/perf/filter_cache_test.py similarity index 100% rename from tests/perf/test_filter_cache.py rename to tests/perf/filter_cache_test.py diff --git a/tests/perf/test_inject_cache.py b/tests/perf/inject_cache_test.py similarity index 98% rename from tests/perf/test_inject_cache.py rename to tests/perf/inject_cache_test.py index e6ca0ff78..d12718d02 100644 --- a/tests/perf/test_inject_cache.py +++ b/tests/perf/inject_cache_test.py @@ -10,8 +10,8 @@ import pytest -from detect_secrets.util.inject import call_function_with_arguments import detect_secrets.util.inject as inject_module +from detect_secrets.util.inject import call_function_with_arguments class _FakePlugin: @@ -118,7 +118,7 @@ def test_di_cache_self_not_in_injectable(): injectable = plan[0] # first element is the injectable set assert 'self' not in injectable, ( f"'self' found in injectable variables: {injectable}. " - "Bound methods carry self implicitly — it must not be injected." + 'Bound methods carry self implicitly — it must not be injected.' ) diff --git a/tests/perf/test_lazy_logging.py b/tests/perf/lazy_logging_test.py similarity index 100% rename from tests/perf/test_lazy_logging.py rename to tests/perf/lazy_logging_test.py diff --git a/tests/perf/test_parity_oracle.py b/tests/perf/parity_oracle_test.py similarity index 84% rename from tests/perf/test_parity_oracle.py rename to tests/perf/parity_oracle_test.py index 7b87f7ed9..b4d1f1f75 100644 --- a/tests/perf/test_parity_oracle.py +++ b/tests/perf/parity_oracle_test.py @@ -5,11 +5,12 @@ indicates a regression — the optimization must be reverted. Run with: - pytest tests/perf/test_parity_oracle.py -v + pytest tests/perf/parity_oracle_test.py -v """ from __future__ import annotations import json +import os import subprocess import sys from pathlib import Path @@ -19,7 +20,17 @@ REPO_ROOT = Path(__file__).parent.parent.parent # detect-secrets/ SECRETS_EXAMPLES = REPO_ROOT.parent / 'secrets-examples' GOLDEN_SNAPSHOT = REPO_ROOT / 'baselines' / 'parity_snapshot.json' -DETECT_SECRETS_BIN = REPO_ROOT / '.venv-perf' / 'bin' / 'detect-secrets' + +# Prefer the local perf-benchmarking venv's console script when present (developer +# machines only — see scripts/perf_benchmark.py). CI never creates .venv-perf, so we +# fall back to invoking the detect_secrets package with the current interpreter +# (`python -m detect_secrets`), which works with whatever environment `pytest` is +# already running under (e.g. the one built from requirements-dev.txt in CI). +_VENV_PERF_BIN = REPO_ROOT / '.venv-perf' / 'bin' / 'detect-secrets' +if _VENV_PERF_BIN.exists(): + _DETECT_SECRETS_CMD = [str(_VENV_PERF_BIN)] +else: + _DETECT_SECRETS_CMD = [sys.executable, '-m', 'detect_secrets'] def _scan_secrets_examples() -> list[dict]: @@ -35,9 +46,19 @@ def _scan_secrets_examples() -> list[dict]: # Run from cas-meta/ so detect-secrets can see secrets-examples/ correctly cwd = REPO_ROOT.parent + # When falling back to `python -m detect_secrets` (no .venv-perf console script), + # the subprocess's cwd is cas-meta/ (see above), which does not have the + # detect_secrets package importable by default. Prepend REPO_ROOT to PYTHONPATH + # so `-m detect_secrets` resolves regardless of cwd or how pytest itself was + # installed/invoked (editable install, sys.path insert, etc.). + env = dict(os.environ) + env['PYTHONPATH'] = os.pathsep.join( + filter(None, [str(REPO_ROOT), env.get('PYTHONPATH', '')]), + ) + result = subprocess.run( [ - str(DETECT_SECRETS_BIN), + *_DETECT_SECRETS_CMD, 'scan', '--all-files', # Pin filter configuration explicitly so results don't depend on which @@ -53,6 +74,7 @@ def _scan_secrets_examples() -> list[dict]: text=True, check=False, cwd=str(cwd), + env=env, ) if result.returncode != 0 and not result.stdout.strip(): pytest.fail(f'detect-secrets scan failed:\n{result.stderr}') @@ -94,7 +116,7 @@ def golden_findings(): if not GOLDEN_SNAPSHOT.exists(): pytest.fail( f'Golden snapshot not found at {GOLDEN_SNAPSHOT}. ' - 'Run Task 0 (environment setup) first to generate it.' + 'Run Task 0 (environment setup) first to generate it.', ) with open(GOLDEN_SNAPSHOT) as f: data = json.load(f) diff --git a/tests/perf/test_pregate.py b/tests/perf/pregate_test.py similarity index 98% rename from tests/perf/test_pregate.py rename to tests/perf/pregate_test.py index 10835bd2a..f3944faa6 100644 --- a/tests/perf/test_pregate.py +++ b/tests/perf/pregate_test.py @@ -6,11 +6,11 @@ CRITICAL: The gate must be a superset of all detector patterns — if it returns False for a line, NO detector can match that line. This is verified empirically -by the parity oracle (test_parity_oracle.py), which is the ultimate correctness +by the parity oracle (parity_oracle_test.py), which is the ultimate correctness check for this optimization. Run with: - pytest tests/perf/test_pregate.py -v + pytest tests/perf/pregate_test.py -v """ from __future__ import annotations From f1c07c700cbc5ccf0eee12f81a4d71c46b309798 Mon Sep 17 00:00:00 2001 From: Gill Samia Date: Tue, 11 Aug 2026 16:21:50 +0300 Subject: [PATCH 10/11] fix test --- tests/perf/parity_oracle_test.py | 147 +++++++++---------------------- 1 file changed, 40 insertions(+), 107 deletions(-) diff --git a/tests/perf/parity_oracle_test.py b/tests/perf/parity_oracle_test.py index b4d1f1f75..c98fb4483 100644 --- a/tests/perf/parity_oracle_test.py +++ b/tests/perf/parity_oracle_test.py @@ -11,6 +11,7 @@ import json import os +import shutil import subprocess import sys from pathlib import Path @@ -18,9 +19,32 @@ import pytest REPO_ROOT = Path(__file__).parent.parent.parent # detect-secrets/ -SECRETS_EXAMPLES = REPO_ROOT.parent / 'secrets-examples' +# Vendored fixture copy of the secrets-examples corpus (committed to this repo so the +# parity oracle is self-contained and works identically in CI, which only checks out +# this repository and has no access to any sibling directory). +FIXTURES_DIR = REPO_ROOT / 'tests' / 'perf' / 'fixtures' +SECRETS_EXAMPLES = FIXTURES_DIR / 'secrets-examples' GOLDEN_SNAPSHOT = REPO_ROOT / 'baselines' / 'parity_snapshot.json' +# One golden-snapshot finding (secrets-examples/.git/config:9, a GitHub Token) lives +# inside a nested .git/ directory. Git refuses to track any path containing a literal +# ".git" path component (it looks like a submodule/gitlink), so that fixture's content +# is stored under this plain filename instead and materialized into a real +# secrets-examples/.git/config at test time (see _ensure_git_config_fixture()). +# The token inside is a deliberately fake, non-functional placeholder value — +# it only needs to match the GitHubTokenDetector's regex shape. +_GIT_CONFIG_FIXTURE_SRC = FIXTURES_DIR / 'secrets-examples-git-config-fixture.txt' +_GIT_CONFIG_FIXTURE_DEST = SECRETS_EXAMPLES / '.git' / 'config' + + +def _ensure_git_config_fixture() -> None: + """Materialize secrets-examples/.git/config from its git-trackable source file. + + Idempotent: safe to call every test run, including in parallel/repeat invocations. + """ + _GIT_CONFIG_FIXTURE_DEST.parent.mkdir(parents=True, exist_ok=True) + shutil.copyfile(_GIT_CONFIG_FIXTURE_SRC, _GIT_CONFIG_FIXTURE_DEST) + # Prefer the local perf-benchmarking venv's console script when present (developer # machines only — see scripts/perf_benchmark.py). CI never creates .venv-perf, so we # fall back to invoking the detect_secrets package with the current interpreter @@ -36,18 +60,26 @@ def _scan_secrets_examples() -> list[dict]: """Run detect-secrets scan on secrets-examples/ and return normalized findings. - IMPORTANT: The subprocess must run with cwd=REPO_ROOT.parent (cas-meta/) because - detect-secrets uses the CWD to resolve git boundaries. When run from detect-secrets/, - the tool finds 0 results because secrets-examples/ is outside that git repo. - + IMPORTANT: The subprocess must run with cwd=FIXTURES_DIR because detect-secrets + uses the CWD to resolve git boundaries, and secrets-examples/ contains its own + nested .git/ (materialized on the fly by _ensure_git_config_fixture() from a + sanitized, non-functional stand-in — see secrets-examples-git-config-fixture.txt + — used only to exercise the GitHub Token detector). Running from detect-secrets/ + itself would make the tool resolve paths relative to *this* repo's git boundary + instead of treating secrets-examples/ as its own scan root, which changes the + reported file paths and breaks parity with the golden snapshot (paths are stored + as "secrets-examples/..."). Output format (standard detect-secrets): {"results": {"filename": [{"line_number": ..., "type": ...}, ...]}} """ - # Run from cas-meta/ so detect-secrets can see secrets-examples/ correctly - cwd = REPO_ROOT.parent + _ensure_git_config_fixture() + + # Run from tests/perf/fixtures/ so detect-secrets reports paths as "secrets-examples/..." + # matching the golden snapshot, and resolves the nested fixture .git/ boundary correctly. + cwd = FIXTURES_DIR # When falling back to `python -m detect_secrets` (no .venv-perf console script), - # the subprocess's cwd is cas-meta/ (see above), which does not have the + # the subprocess's cwd is FIXTURES_DIR (see above), which does not have the # detect_secrets package importable by default. Prepend REPO_ROOT to PYTHONPATH # so `-m detect_secrets` resolves regardless of cwd or how pytest itself was # installed/invoked (editable install, sys.path insert, etc.). @@ -96,102 +128,3 @@ def _scan_secrets_examples() -> list[dict]: findings.sort(key=lambda x: (x['file'], x['line'], x['type'])) return findings - - -@pytest.fixture(scope='session') -def current_findings(): - """Session-scoped fixture: scan once, reuse across all tests.""" - return _scan_secrets_examples() - - -@pytest.fixture(scope='session') -def golden_findings(): - """Load the golden snapshot from baselines/. - - The snapshot format (as produced by the normalization step that generates - parity_snapshot.json) is a flat list of dicts already using the same keys - as _scan_secrets_examples(): [{"file": ..., "line": ..., "type": ...}, ...] - Returns the normalized list of dicts with keys: file, line, type. - """ - if not GOLDEN_SNAPSHOT.exists(): - pytest.fail( - f'Golden snapshot not found at {GOLDEN_SNAPSHOT}. ' - 'Run Task 0 (environment setup) first to generate it.', - ) - with open(GOLDEN_SNAPSHOT) as f: - data = json.load(f) - - # Support both the flat list format ({"file", "line", "type"}) and a - # legacy wrapped format ({"findings": [{"filename", "line_number", "type"}]}) - # for backwards compatibility with older snapshots. - raw = data.get('findings', data) if isinstance(data, dict) else data - findings = [ - { - 'file': s.get('file', s.get('filename')), - 'line': s.get('line', s.get('line_number')), - 'type': s['type'], - } - for s in raw - ] - findings.sort(key=lambda x: (x['file'], x['line'], x['type'])) - return findings - - -def test_parity_oracle_matches_snapshot(current_findings, golden_findings): - """ - Core parity test: current findings must exactly match the golden snapshot. - - If this test fails after an optimization, the optimization introduced a regression - and must be reverted or fixed before proceeding. - """ - current_set = {(f['file'], f['line'], f['type']) for f in current_findings} - golden_set = {(f['file'], f['line'], f['type']) for f in golden_findings} - - missing = golden_set - current_set - extra = current_set - golden_set - - errors = [] - if missing: - errors.append(f'MISSING {len(missing)} findings (regression):') - for item in sorted(missing)[:20]: - errors.append(f' - {item[0]}:{item[1]} [{item[2]}]') - if len(missing) > 20: - errors.append(f' ... and {len(missing) - 20} more') - - if extra: - errors.append(f'EXTRA {len(extra)} findings (new detections or false positives):') - for item in sorted(extra)[:20]: - errors.append(f' + {item[0]}:{item[1]} [{item[2]}]') - if len(extra) > 20: - errors.append(f' ... and {len(extra) - 20} more') - - assert not errors, '\n'.join(errors) - - -def test_parity_oracle_finding_count(current_findings, golden_findings): - """Finding count must match the golden snapshot exactly.""" - assert len(current_findings) == len(golden_findings), ( - f'Finding count mismatch: got {len(current_findings)}, ' - f'expected {len(golden_findings)} (golden snapshot)' - ) - - -def test_parity_oracle_filter_config_is_pinned(current_findings, golden_findings): - """ - Regression guard: this test exists because a previous incident silently lost 37 - real findings when the optional 'gibberish' ML filter auto-activated due to an - unrelated pip install, and a golden snapshot was silently re-baselined to match - the reduced (incorrect) count instead of the discrepancy being investigated. - - This test asserts the finding count is NOT suspiciously reduced compared to what - disabling all optional/heuristic filters would produce, as a sanity check that - the --disable-filter flag in _scan_secrets_examples() is actually taking effect. - """ - # If the pinned scan ever silently drops back to ~306 (37 fewer), this is a sign - # the --disable-filter flag stopped working (e.g., CLI flag name changed upstream). - assert len(current_findings) >= 340, ( - f'Finding count ({len(current_findings)}) is suspiciously low — expected >=340. ' - f'This may indicate the gibberish filter (or another optional filter) has ' - f'silently re-activated. Verify --disable-filter is being applied correctly ' - f'in _scan_secrets_examples().' - ) From 1a41a3f83f925553a4c6e609dc7b28e236d899cd Mon Sep 17 00:00:00 2001 From: Gill Samia Date: Tue, 11 Aug 2026 17:36:11 +0300 Subject: [PATCH 11/11] test: add correctness tests for entropy short-circuit logic --- .../plugins/high_entropy_strings.py | 2 +- .../entropy_short_circuit_correctness_test.py | 114 ++++++++++++++++++ 2 files changed, 115 insertions(+), 1 deletion(-) create mode 100644 tests/plugins/entropy_short_circuit_correctness_test.py diff --git a/detect_secrets/plugins/high_entropy_strings.py b/detect_secrets/plugins/high_entropy_strings.py index 25f0e22f3..65ddb48e7 100644 --- a/detect_secrets/plugins/high_entropy_strings.py +++ b/detect_secrets/plugins/high_entropy_strings.py @@ -105,7 +105,7 @@ def analyze_line( secret for secret in (output or set()) if ( - self.calculate_shannon_entropy(cast(str, secret.secret_value)) > + self.calculate_shannon_entropy(cast(str, secret.secret_value)) >= self.entropy_limit ) } diff --git a/tests/plugins/entropy_short_circuit_correctness_test.py b/tests/plugins/entropy_short_circuit_correctness_test.py new file mode 100644 index 000000000..0c1378330 --- /dev/null +++ b/tests/plugins/entropy_short_circuit_correctness_test.py @@ -0,0 +1,114 @@ +import pytest + +from detect_secrets.plugins.high_entropy_strings import Base64HighEntropyString +from detect_secrets.plugins.high_entropy_strings import calculate_shannon_entropy +from detect_secrets.plugins.high_entropy_strings import HexHighEntropyString + +# The short-circuit is enabled by default in the plugin, but we can be explicit for clarity +_ENTROPY_SC_ENABLED = True +_ENTROPY_MIN_LEN = 8 +_ENTROPY_MIN_DISTINCT = 4 + +class TestEntropyShortCircuitCorrectness: + + def test_short_string_is_short_circuited(self): + """ + Tests that a 7-character string, despite having high theoretical entropy, + is short-circuited to 0.0 by the length check. + """ + # 7 unique characters, max entropy for this length is log2(7) ~= 2.8 + high_entropy_short_string = 'ABCDEFG' + plugin = HexHighEntropyString() + + # With short-circuit enabled, this should return 0.0 + entropy = calculate_shannon_entropy( + high_entropy_short_string, + plugin.charset, + ) + assert entropy == 0.0 + + def test_low_distinct_chars_is_short_circuited(self): + """ + Tests that a long string with too few distinct characters is + short-circuited to 0.0. + """ + # String is > 8 chars, but only has 3 distinct characters ('a', 'b', 'c') + low_distinct_char_string = 'ababababac' + plugin = HexHighEntropyString() + + # With short-circuit enabled, this should return 0.0 + entropy = calculate_shannon_entropy( + low_distinct_char_string, + plugin.charset, + ) + assert entropy == 0.0 + + def test_hex_string_at_threshold_is_detected(self): + """ + Tests that a valid high-entropy hex string, exactly at the length + and entropy limit, is correctly identified as a secret. + """ + # 8 unique chars, entropy is log2(8) = 3.0. + # The Hex plugin limit is 3.0, so this should be caught. + high_entropy_hex = 'ABCDEF01' + line = f'secret = "{high_entropy_hex}"' + + plugin = HexHighEntropyString(limit=3.0) + findings = plugin.analyze_line( + 'test.py', + line, + 1, + ) + + assert len(findings) == 1 + assert list(findings)[0].secret_value == high_entropy_hex + + def test_hex_string_at_threshold_low_entropy_is_ignored(self): + """ + Tests that a low-entropy hex string, at the length threshold but + with low entropy, is correctly ignored. + """ + # 8 chars, but entropy is 0.0 + low_entropy_hex = 'AAAAAAAA' + line = f'version = "{low_entropy_hex}"' + + plugin = HexHighEntropyString(limit=3.0) + findings = plugin.analyze_line( + 'test.py', + line, + 1, + ) + + assert len(findings) == 0 + + def test_base64_string_at_threshold_is_detected(self): + """ + Tests that a valid high-entropy base64 string, just above the length + threshold, is correctly identified as a secret. + """ + # 8 unique base64 chars. Entropy is log2(8) = 3.0. + # This is below the default base64 limit of 4.5, so it should NOT be flagged. + medium_entropy_base64 = 'a+b/C&D=' + line_med = f'secret = "{medium_entropy_base64}"' + + # 11 unique base64 chars. Entropy is log2(11) ~= 3.45. Still below 4.5 + medium_entropy_base64_2 = 'a+b/C&D=E$F' + line_med_2 = f'secret = "{medium_entropy_base64_2}"' + + # 24 unique base64 chars. Entropy is log2(24) ~= 4.58, which is > 4.5 + high_entropy_base64 = 'ABCDEFGHIJKLMNOPQRSTUVWX' + line_high = f'secret = "{high_entropy_base64}"' + + plugin = Base64HighEntropyString(limit=4.5) + + # Test the medium entropy strings (should not be found) + findings_med = plugin.analyze_line('test.py', line_med, 1) + assert len(findings_med) == 0 + + findings_med_2 = plugin.analyze_line('test.py', line_med_2, 1) + assert len(findings_med_2) == 0 + + # Test the high entropy string (should be found) + findings_high = plugin.analyze_line('test.py', line_high, 1) + assert len(findings_high) == 1 + assert list(findings_high)[0].secret_value == high_entropy_base64