secretsweep 0.1.1 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 30c1e981a0b2a61d6e3a3a27310bf9452bd73f9514b2ed157db4cdf1a71f9f2a
-  data.tar.gz: ddd1724fb438ca24e233bd0fd6880eb9e9bcc1e5aab2bb3914148f958eddd211
+  metadata.gz: 8c6eacc4e23dcefebe23dac26989b385da1309472b664a5ee740ec168a935042
+  data.tar.gz: 250156cd89f9de57d6a426afe0838bbae9edecae1f9783c3627836448e959c5f
 SHA512:
-  metadata.gz: 145620e757aba1463d59a4133abe25a86be73130bb2ac4f695f4f904103f80d871940d29cd694bdd1909df5ea031a7468bad3861d82f1e3ab68ef2388b4949a7
-  data.tar.gz: 93aab1bc3fb8a6e94692c28cde906af94c6d42f59333f165e336e3075dea45adcdc74d204e4aadb91a37e595d7aa4580bbea545ef6cc721f08b00062a3686214
+  metadata.gz: b1970d66615a8ad00bacb071ecf6627733b5b24c2ce9552343f7c0c889317835f74a16a53ed22085a75be1472fdfe25fb32f389c25c61e91e2bfb1c9f6361e5e
+  data.tar.gz: dba748c56fb40b5afb8739d4e994631a85fac2e1ad8b497a123041289537f885c19d4c74e76007918115775cf079c283679a9f9b07c427a5544e8f7d6f4937a4

data/CHANGELOG.md

@@ -0,0 +1,46 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.1.2] - 2026-09-09
+
+### Added
+
+- GitHub Actions CI workflow (`.github/workflows/ci.yml`) running RSpec, Rubocop, and RBS signature validation on every push and pull request, across Ruby 3.0–3.3.
+- `metadata` in the gemspec (`homepage_uri`, `source_code_uri`, `changelog_uri`, `bug_tracker_uri`) for better discoverability on RubyGems.org.
+
+### Fixed
+
+- Gemspec development dependencies corrected: `rspec` and `rbs` replace the stale `minitest` reference left over from the pre-migration scaffold.
+- `sig/**/*.rbs` and `CHANGELOG.md` are now actually included in the packaged gem — previous versions omitted the type signatures entirely despite them existing in the repo.
+
+## [0.1.1] - 2026-09-07
+
+### Fixed
+
+- Corrected the homepage/source code URL in `secretsweep.gemspec` to point to the actual GitHub repository.
+
+## [0.1.0] - 2026-09-05
+
+### Added
+
+- Core secret-detection engine combining two independent methods:
+  - Pattern matching (`PatternRegistry`) for known formats: AWS keys, GitHub/Slack/Stripe tokens, PEM private key headers, Google API keys, JWTs, and a generic key-assignment heuristic.
+  - Shannon entropy analysis (`Entropy`) to catch high-entropy strings that don't match any known format.
+- `FileScanner` — scans a directory tree for secrets in the current working tree, skipping binary files and common noise directories (`node_modules`, `.git`, `vendor`, etc.).
+- `GitHistoryScanner` — scans full git history across all branches (`git log -p --all`) to catch secrets that were committed and later removed but are still readable in history.
+- `IgnoreList` / `.secretsweepignore` support with two levels of granularity: path globs (skip a directory entirely) and per-finding fingerprints (allowlist one confirmed false positive without silencing the whole rule).
+- Stable, content-based fingerprinting (`Finding#fingerprint`) so ignore-list entries survive unrelated edits to the same file.
+- CLI (`bin/secretsweep`) with `--history`, `--format [text|json]`, and `--ignore-file` flags, and meaningful exit codes (0 clean / 1 secrets found / 2 error).
+- Text and JSON report output via `Reporter`.
+- Full RSpec test suite (37 examples), including an end-to-end test that creates a real throwaway git repo, commits a secret, removes it in a later commit, and verifies history scanning still finds it.
+- RBS type signatures for the full public API.
+- Zero runtime dependencies — pure Ruby standard library (`optparse`, `json`, `open3`, `digest`, `pathname`, `find`).
+
+### Known limitations
+
+- The same secret can be reported twice (once per detection method) if it satisfies both pattern matching and entropy analysis. This is intentional — see README for reasoning.
+- Entropy thresholds are heuristic, not yet validated against a large real-world sample.

data/README.md

@@ -2,9 +2,10 @@
 
 **A dependency-free Ruby CLI that scans files and full git history for leaked secrets — API keys, tokens, private keys — using known-format patterns plus entropy analysis for everything else.**
 
+![CI](https://github.com/Majd2404/SecretSweep/actions/workflows/ci.yml/badge.svg)
+![Gem Version](https://badge.fury.io/rb/secretsweep.svg)
 ![Ruby](https://img.shields.io/badge/Ruby-3.0%2B-CC342D?logo=ruby&logoColor=white)
 ![Dependencies](https://img.shields.io/badge/runtime_deps-zero-brightgreen)
-![Tests](https://img.shields.io/badge/tests-36_passing-brightgreen)
 ![License](https://img.shields.io/badge/license-MIT-blue)
 
 ## Why this exists
@@ -34,12 +35,20 @@ rather than "fixed."
 
 ## Installation
 
+SecretSweep is published on RubyGems:
+
+```bash
+gem install secretsweep
+```
+
+Or from source:
+
 ```bash
 git clone https://github.com/Majd2404/SecretSweep.git
 cd SecretSweep
 bundle install
 gem build secretsweep.gemspec
-gem install ./secretsweep-0.1.0.gem
+gem install ./secretsweep-*.gem
 ```
 
 ## Usage
@@ -84,7 +93,7 @@ directory you're scanning. Two kinds of entries:
 
 ```
 # Skip scanning these paths entirely
-test/fixtures/**
+spec/fixtures/**
 
 # Allowlist ONE specific confirmed false positive by its fingerprint
 # (does NOT silence the whole rule — just that exact file+type+snippet)
@@ -120,12 +129,9 @@ a1b2c3d4e5f6
   GitHub token is both a recognized format *and* high-entropy). This is
   left as-is rather than deduplicated across types: two independent
   detectors agreeing is a legitimate confidence signal, and collapsing
-  it would hide which detector(s) actually fired. See
-  `docs/COMMIT_PLAN.md` for a possible future confidence-scoring
-  approach instead of outright deduplication.
-- **Entropy thresholds are heuristic**, not universally tuned — see
-  `docs/COMMIT_PLAN.md` Week 2 for the plan to validate them against a
-  larger real-world sample.
+  it would hide which detector(s) actually fired.
+- **Entropy thresholds are heuristic**, not yet validated against a
+  large real-world sample.
 - **History scanning reads the full diff of every commit on every
   branch** (`git log -p --all`) — this is thorough but can be slow on
   very large, long-lived repositories. No pagination/depth limit yet.
@@ -133,23 +139,28 @@ a1b2c3d4e5f6
 ## Testing
 
 ```bash
-rake test
+bundle exec rspec
 ```
 
-36 tests, zero dependencies beyond Ruby's bundled Minitest — no network
-access or external services required to run the suite. Includes a real
-integration test (`git_history_scanner_test.rb`) that creates an actual
-throwaway git repo, commits a secret, removes it in a later commit, and
-verifies `--history` still catches it.
+37 RSpec examples, including a real end-to-end test
+(`git_history_scanner_spec.rb`) that creates an actual throwaway git
+repo, commits a secret, removes it in a later commit, and verifies
+`--history` still catches it.
+
+Type signatures are validated separately:
 
-## Roadmap
+```bash
+bundle exec rbs -I sig validate
+```
 
-See [`docs/COMMIT_PLAN.md`](docs/COMMIT_PLAN.md) for the week-by-week build-out plan.
+Both run automatically on every push via GitHub Actions across Ruby
+3.0–3.3 — see the CI badge above.
 
 ## Tech stack
 
-Ruby 3.0+, standard library only. Minitest + Rake for testing.
+Ruby 3.0+, standard library only. RSpec for testing, RBS for type
+signatures, Rubocop for style, GitHub Actions for CI.
 
 ## License
 
-MIT — see [LICENSE](LICENSE).
+MIT — see [LICENSE](LICENSE).

data/lib/secretsweep/cli.rb

@@ -18,28 +18,33 @@ module SecretSweep
 
     def run(argv)
       options = parse(argv)
-      path = options[:path] || "."
-
-      scanner = Scanner.new(path, ignore_file: options[:ignore_file], include_history: options[:history])
-      findings = scanner.run
+      findings = scan(options)
 
       puts Reporter.render(findings, format: options[:format])
-
       findings.empty? ? EXIT_CLEAN : EXIT_SECRETS_FOUND
-    rescue GitHistoryScanner::NotAGitRepoError => e
-      warn "Error: #{e.message}"
-      EXIT_ERROR
-    rescue Errno::ENOENT => e
+    rescue GitHistoryScanner::NotAGitRepoError, Errno::ENOENT => e
       warn "Error: #{e.message}"
       EXIT_ERROR
     end
 
     private
 
+    def scan(options)
+      path = options[:path] || "."
+      Scanner.new(path, ignore_file: options[:ignore_file], include_history: options[:history]).run
+    end
+
     def parse(argv)
       options = { format: :text, history: false }
+      parser = build_option_parser(options)
 
-      parser = OptionParser.new do |opts|
+      remaining = parser.parse(argv)
+      options[:path] = remaining.first
+      options
+    end
+
+    def build_option_parser(options)
+      OptionParser.new do |opts|
         opts.banner = "Usage: secretsweep [path] [options]"
 
         opts.on("--history", "Also scan full git history, not just the working tree") do
@@ -64,10 +69,6 @@ module SecretSweep
           exit(0)
         end
       end
-
-      remaining = parser.parse(argv)
-      options[:path] = remaining.first
-      options
     end
   end
 end

data/lib/secretsweep/file_scanner.rb

@@ -50,17 +50,7 @@ module SecretSweep
       findings = []
 
       File.foreach(path).with_index(1) do |line, line_number|
-        # Guard per-line, not per-file: one malformed line (bad encoding,
-        # unexpected control characters) should never discard matches
-        # already found earlier in the same file.
-        begin
-          PatternRegistry.scan_line(line).each do |match|
-            findings << Finding.new(relative_path, line_number, match[:type], match[:snippet], nil)
-          end
-          check_high_entropy_tokens(line, relative_path, line_number, findings)
-        rescue ArgumentError, Encoding::InvalidByteSequenceError
-          next
-        end
+        findings.concat(scan_line_safely(line, relative_path, line_number))
       end
 
       findings
@@ -70,13 +60,26 @@ module SecretSweep
       findings
     end
 
+    # Guards per-line, not per-file: one malformed line (bad encoding,
+    # unexpected control characters) should never discard matches already
+    # found earlier in the same file.
+    def scan_line_safely(line, relative_path, line_number)
+      findings = PatternRegistry.scan_line(line).map do |match|
+        Finding.new(relative_path, line_number, match[:type], match[:snippet], nil)
+      end
+      check_high_entropy_tokens(line, relative_path, line_number, findings)
+      findings
+    rescue ArgumentError, Encoding::InvalidByteSequenceError
+      []
+    end
+
     # Beyond known patterns, flag bare high-entropy tokens assigned to a
     # variable — catches secrets in formats we don't have a specific regex
     # for yet (a new provider's token format, an internal auth token).
     def check_high_entropy_tokens(line, relative_path, line_number, findings)
       return unless line.match?(/=|:/)
 
-      line.scan(/['"]([A-Za-z0-9\/+_-]{20,})['"]/) do |match|
+      line.scan(%r{['"]([A-Za-z0-9/+_-]{20,})['"]}) do |match|
         token = match[0]
         next unless Entropy.high_entropy?(token)
 

data/lib/secretsweep/git_history_scanner.rb

@@ -10,6 +10,16 @@ module SecretSweep
   class GitHistoryScanner
     class NotAGitRepoError < StandardError; end
 
+    # Tracks the small bit of state needed while walking `git log -p`
+    # output line by line: which commit and file we're currently inside,
+    # plus the findings accumulated so far. Extracted from Scanner so
+    # #scan itself stays a short, readable dispatch loop.
+    State = Struct.new(:commit, :file, :findings) do
+      def initialize
+        super(nil, nil, [])
+      end
+    end
+
     def initialize(repo_path, ignore_list: IgnoreList.new([], []))
       @repo_path = repo_path
       @ignore_list = ignore_list
@@ -18,41 +28,43 @@ module SecretSweep
     def scan
       raise NotAGitRepoError, "#{@repo_path} is not a git repository" unless git_repo?
 
-      findings = []
-      current_file = nil
-      current_commit = nil
-
-      each_diff_line do |line|
-        if line.start_with?("commit ")
-          current_commit = line.split(" ", 2).last[0, 12]
-        elsif line.start_with?("+++ b/")
-          current_file = line.sub("+++ b/", "").strip
-        elsif line.start_with?("+") && !line.start_with?("+++")
-          content = line[1..]
-          next if current_file.nil? || @ignore_list.path_ignored?(current_file)
-
-          PatternRegistry.scan_line(content).each do |match|
-            findings << Finding.new(current_file, nil, match[:type], match[:snippet], current_commit)
-          end
-        end
-      end
-
-      findings
+      state = State.new
+      each_diff_line { |line| process_line(line, state) }
+      state.findings
     end
 
     private
 
+    def process_line(line, state)
+      case line
+      when /\Acommit /
+        state.commit = line.split(" ", 2).last[0, 12]
+      when %r{\A\+\+\+ b/}
+        state.file = line.sub("+++ b/", "").strip
+      when /\A\+(?!\+\+)/
+        record_added_line(line[1..], state)
+      end
+    end
+
+    def record_added_line(content, state)
+      return if state.file.nil? || @ignore_list.path_ignored?(state.file)
+
+      PatternRegistry.scan_line(content).each do |match|
+        state.findings << Finding.new(state.file, nil, match[:type], match[:snippet], state.commit)
+      end
+    end
+
     def git_repo?
       _out, status = Open3.capture2("git", "-C", @repo_path, "rev-parse", "--is-inside-work-tree")
       status.success?
     end
 
-    def each_diff_line
+    def each_diff_line(&block)
       # -p: show patches (actual added/removed lines), --all: every branch,
       # not just the currently checked-out one — a secret on a stale
       # feature branch is still a leak.
       Open3.popen2("git", "-C", @repo_path, "log", "-p", "--all", "--no-color") do |_in, out, _thread|
-        out.each_line { |line| yield line }
+        out.each_line(&block)
       end
     end
   end

data/lib/secretsweep/ignore_list.rb

@@ -13,22 +13,24 @@ module SecretSweep
     def self.load(path)
       return new([], []) unless path && File.exist?(path)
 
+      globs, fingerprints = partition_lines(File.readlines(path))
+      new(globs, fingerprints)
+    end
+
+    def self.partition_lines(raw_lines)
       globs = []
       fingerprints = []
 
-      File.readlines(path).each do |raw_line|
+      raw_lines.each do |raw_line|
         line = raw_line.strip
         next if line.empty? || line.start_with?("#")
 
-        if line.match?(/\A[0-9a-f]{12}\z/)
-          fingerprints << line
-        else
-          globs << line
-        end
+        line.match?(/\A[0-9a-f]{12}\z/) ? fingerprints << line : globs << line
       end
 
-      new(globs, fingerprints)
+      [globs, fingerprints]
     end
+    private_class_method :partition_lines
 
     def initialize(path_globs, fingerprints)
       @path_globs = path_globs

data/lib/secretsweep/pattern_registry.rb

@@ -8,7 +8,7 @@ module SecretSweep
   module PatternRegistry
     PATTERNS = {
       "aws_access_key_id" => /\bAKIA[0-9A-Z]{16}\b/,
-      "aws_secret_access_key" => /\baws(.{0,20})?(secret|access)[_-]?key\b.{0,5}['"]([A-Za-z0-9\/+=]{40})['"]/i,
+      "aws_secret_access_key" => %r{\baws(.{0,20})?(secret|access)[_-]?key\b.{0,5}['"]([A-Za-z0-9/+=]{40})['"]}i,
       "github_token" => /\bgh[pousr]_[A-Za-z0-9]{36,}\b/,
       "slack_token" => /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/,
       "stripe_live_key" => /\bsk_live_[A-Za-z0-9]{24,}\b/,
@@ -16,7 +16,7 @@ module SecretSweep
       "generic_private_key" => /-----BEGIN (RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/,
       "google_api_key" => /\bAIza[0-9A-Za-z\-_]{35}\b/,
       "generic_api_key_assignment" =>
-        /\b(api[_-]?key|secret|token|password|passwd|pwd)\b\s*[:=]\s*['"][A-Za-z0-9\/+=_\-]{16,}['"]/i,
+        %r{\b(api[_-]?key|secret|token|password|passwd|pwd)\b\s*[:=]\s*['"][A-Za-z0-9/+=_-]{16,}['"]}i,
       "jwt" => /\bey[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/
     }.freeze
 

data/lib/secretsweep/scanner.rb

@@ -15,9 +15,7 @@ module SecretSweep
     def run
       findings = FileScanner.new(@path, ignore_list: @ignore_list).scan
 
-      if @include_history
-        findings.concat(GitHistoryScanner.new(@path, ignore_list: @ignore_list).scan)
-      end
+      findings.concat(GitHistoryScanner.new(@path, ignore_list: @ignore_list).scan) if @include_history
 
       dedupe(@ignore_list.reject_ignored(findings))
     end

data/lib/secretsweep/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module SecretSweep
-  VERSION = "0.1.1"
+  VERSION = "0.1.2"
 end

data/sig/secretsweep/cli.rbs

@@ -0,0 +1,15 @@
+module SecretSweep
+  class CLI
+    EXIT_CLEAN: Integer
+    EXIT_SECRETS_FOUND: Integer
+    EXIT_ERROR: Integer
+
+    def self.start: (Array[String] argv) -> Integer
+
+    def run: (Array[String] argv) -> Integer
+
+    private
+
+    def parse: (Array[String] argv) -> Hash[Symbol, untyped]
+  end
+end

data/sig/secretsweep/entropy.rbs

@@ -0,0 +1,9 @@
+module SecretSweep
+  module Entropy
+    DEFAULT_THRESHOLD: Float
+
+    def self.shannon: (String? str) -> Float
+
+    def self.high_entropy?: (String? str, ?threshold: Float, ?min_length: Integer) -> bool
+  end
+end

data/sig/secretsweep/file_scanner.rbs

@@ -0,0 +1,22 @@
+module SecretSweep
+  class FileScanner
+    SKIP_DIRS: Array[String]
+    MAX_FILE_SIZE: Integer
+
+    def initialize: (String root, ?ignore_list: IgnoreList) -> void
+
+    def scan: () -> Array[Finding]
+
+    private
+
+    def each_scannable_file: () { (String path) -> void } -> void
+
+    def scan_file: (String path, String relative_path) -> Array[Finding]
+
+    def check_high_entropy_tokens: (String line, String relative_path, Integer line_number, Array[Finding] findings) -> void
+
+    def relative: (String path) -> String
+
+    def binary?: (String path) -> bool
+  end
+end

data/sig/secretsweep/finding.rbs

@@ -0,0 +1,17 @@
+module SecretSweep
+  class Finding
+    attr_reader source: String
+    attr_reader line_number: Integer?
+    attr_reader type: String
+    attr_reader snippet: String
+    attr_reader commit: String?
+
+    def initialize: (String source, Integer? line_number, String type, String snippet, String? commit) -> void
+
+    def fingerprint: () -> String
+
+    def redacted_snippet: () -> String
+
+    def to_h: () -> Hash[Symbol, untyped]
+  end
+end

data/sig/secretsweep/git_history_scanner.rbs

@@ -0,0 +1,16 @@
+module SecretSweep
+  class GitHistoryScanner
+    class NotAGitRepoError < StandardError
+    end
+
+    def initialize: (String repo_path, ?ignore_list: IgnoreList) -> void
+
+    def scan: () -> Array[Finding]
+
+    private
+
+    def git_repo?: () -> bool
+
+    def each_diff_line: () { (String line) -> void } -> void
+  end
+end

data/sig/secretsweep/ignore_list.rbs

@@ -0,0 +1,13 @@
+module SecretSweep
+  class IgnoreList
+    def self.load: (String? path) -> IgnoreList
+
+    def initialize: (Array[String] path_globs, Array[String] fingerprints) -> void
+
+    def path_ignored?: (String path) -> bool
+
+    def finding_ignored?: (Finding finding) -> bool
+
+    def reject_ignored: (Array[Finding] findings) -> Array[Finding]
+  end
+end

data/sig/secretsweep/pattern_registry.rbs

@@ -0,0 +1,10 @@
+module SecretSweep
+  module PatternRegistry
+    type match = { type: String, snippet: String }
+
+    PATTERNS: Hash[String, Regexp]
+    PLACEHOLDER_HINTS: Regexp
+
+    def self.scan_line: (String line) -> Array[match]
+  end
+end

data/sig/secretsweep/reporter.rbs

@@ -0,0 +1,9 @@
+module SecretSweep
+  module Reporter
+    def self.render: (Array[Finding] findings, ?format: Symbol) -> String
+
+    def self.render_text: (Array[Finding] findings) -> String
+
+    def self.render_json: (Array[Finding] findings) -> String
+  end
+end

data/sig/secretsweep/scanner.rbs

@@ -0,0 +1,13 @@
+module SecretSweep
+  class Scanner
+    def initialize: (String path, ?ignore_file: String?, ?include_history: bool) -> void
+
+    def run: () -> Array[Finding]
+
+    private
+
+    def default_ignore_path: () -> String?
+
+    def dedupe: (Array[Finding] findings) -> Array[Finding]
+  end
+end

data/sig/secretsweep.rbs

@@ -0,0 +1,6 @@
+module SecretSweep
+  VERSION: String
+
+  class Error < StandardError
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: secretsweep
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.2
 platform: ruby
 authors:
 - Majd
@@ -10,33 +10,47 @@ cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: minitest
+  name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.20'
+        version: '13.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.20'
+        version: '13.0'
 - !ruby/object:Gem::Dependency
-  name: rake
+  name: rbs
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '13.0'
+        version: '3.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '13.0'
+        version: '3.0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.13'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.13'
 - !ruby/object:Gem::Dependency
   name: rubocop
   requirement: !ruby/object:Gem::Requirement
@@ -61,6 +75,7 @@ executables:
 extensions: []
 extra_rdoc_files: []
 files:
+- CHANGELOG.md
 - LICENSE
 - README.md
 - bin/secretsweep
@@ -75,10 +90,24 @@ files:
 - lib/secretsweep/reporter.rb
 - lib/secretsweep/scanner.rb
 - lib/secretsweep/version.rb
+- sig/secretsweep.rbs
+- sig/secretsweep/cli.rbs
+- sig/secretsweep/entropy.rbs
+- sig/secretsweep/file_scanner.rbs
+- sig/secretsweep/finding.rbs
+- sig/secretsweep/git_history_scanner.rbs
+- sig/secretsweep/ignore_list.rbs
+- sig/secretsweep/pattern_registry.rbs
+- sig/secretsweep/reporter.rbs
+- sig/secretsweep/scanner.rbs
 homepage: https://github.com/Majd2404/SecretSweep
 licenses:
 - MIT
-metadata: {}
+metadata:
+  homepage_uri: https://github.com/Majd2404/SecretSweep
+  source_code_uri: https://github.com/Majd2404/SecretSweep
+  changelog_uri: https://github.com/Majd2404/SecretSweep/blob/main/CHANGELOG.md
+  bug_tracker_uri: https://github.com/Majd2404/SecretSweep/issues
 rdoc_options: []
 require_paths:
 - lib