@anomira/node-sdk 0.1.3 → 0.1.5

package/README.md

@@ -118,13 +118,55 @@ if (match?.rule.action === "block") {
 
 ## Secret Scanner CLI
 
-Scan your codebase for hardcoded secrets, API keys, and PII before they reach production:
+Scan your codebase for hardcoded secrets, API keys, BVN/NIN numbers, and PII before they reach production.
 
+Uses three detection layers:
+- **secretlint** — 50+ service-specific rules (AWS, GCP, GitHub, Stripe, Slack, Twilio, SendGrid, PostgreSQL connection strings, and more)
+- **Custom patterns** — Nigerian PII (BVN/NIN), card PANs, phone numbers
+- **Entropy analysis** (`--strict`) — catches unknown high-entropy secrets with no known prefix, using Shannon entropy scoring
+
+**Run without installing:**
+```bash
+npx @anomira/node-sdk scan ./src
+```
+
+**If `@anomira/node-sdk` is already installed in your project:**
 ```bash
 npx anomira scan ./src
 ```
 
-Exit code `1` if violations are found — CI/CD compatible.
+**Options:**
+```bash
+npx @anomira/node-sdk scan ./src           # scan a directory
+npx @anomira/node-sdk scan .               # scan entire project
+npx @anomira/node-sdk scan ./src --strict  # enable entropy analysis (catches unknown secrets)
+npx @anomira/node-sdk scan ./src --json    # machine-readable JSON output for CI
+npx @anomira/node-sdk scan ./src --quiet   # only print violations, no header
+```
+
+**What it detects:**
+
+| Category | Examples |
+|---|---|
+| Cloud credentials | AWS access keys, GCP service account keys, Azure connection strings |
+| Source control | GitHub tokens (`ghp_`), GitLab tokens (`glpat-`), NPM tokens (`npm_`) |
+| Payment | Stripe keys (`sk_live_`), Paystack keys |
+| Communication | Slack tokens (`xoxb-`), Twilio credentials, SendGrid keys |
+| Database | Connection strings with embedded passwords (`postgresql://user:pass@host`) |
+| Auth | JWT tokens, generic API keys and bearer tokens |
+| Nigerian PII | BVN/NIN (11-digit), card PANs, Nigerian phone numbers |
+| Unknown secrets | High-entropy strings assigned to secret-like variables (`--strict`) |
+
+**Add to `package.json` for CI/CD:**
+```json
+{
+  "scripts": {
+    "scan": "anomira scan ./src --json"
+  }
+}
+```
+
+Exit code `0` = clean. Exit code `1` = violations found — use in CI to fail the build on leaked secrets.
 
 ## Environment Variables