@broberg/secret-scan 0.14.3 → 0.16.1

package/README.md

@@ -36,6 +36,25 @@ const { redacted, findings } = redactSecrets("the key is sk-ant-api03-… use it
 hasSecret("nothing here"); // false
 ```
 
+## CLI — `secret-scan --stdin` (v0.16.1)
+
+For a git hook or a CI step, without embedding a script:
+
+```bash
+git diff --cached | npx secret-scan --stdin
+```
+
+Prints `<label> line <n>` for each finding — **never the value** — and exits
+**1** on a finding, **0** when nothing was found, **2** when it could not scan.
+A secret spanning lines (a PEM key) is reported as `(spans several lines)`.
+Same pattern set and defaults as `redactSecrets(text)` (format axis only).
+
+v0.16.1 also adds `bearer-token` and `labeled-token-param` (`token=`, `key=`,
+`secret=` …): a value of 24+ characters mixing letters and digits, so
+`Bearer <token>`, `${TOKEN}` and plain words are left alone; and `upmetrics-key`
+now takes 32–64 alphanumerics after `uk_`. The fleet gitleaks config
+(`secret-gate/gitleaks.toml`) carries the same fleet formats (F090.6).
+
 `redactSecrets` is **pure + deterministic**: clean input returns byte-identical
 with `findings: []`. It replaces every detected secret with `[REDACTED:<label>]`
 and never blocks the write — the surrounding knowledge survives.
@@ -287,9 +306,17 @@ import { hasPersonalData, findPersonalData, redactPersonalData } from '@broberg/
 
 if (hasPersonalData(candidate)) refuse();
 findPersonalData('tlf 20304050') // → [{ kind: 'phone', start: 4, end: 12 }]
-redactPersonalData('Anne 010190-1234') // → { redacted: 'Anne [REDACTED:cpr]', findings: [{ kind: 'cpr', count: 1 }], scanned: ['cpr', 'phone', 'email'] }
+redactPersonalData('Anne 010190-1234') // → { redacted: 'Anne [REDACTED:cpr]', findings: [{ kind: 'cpr', count: 1 }], scanned: ['cpr', 'phone', 'email'], notExamined: ['names', 'addresses', 'health-details'] }
 ```
 
+**Both results say what they NEVER look at (0.15.0, F079.6).** `redactSecrets(...).notExamined`
+is always `['personal-data']`: it scans secrets only, and a message full of CPR numbers
+returns `findings: []` from it — correct, and indistinguishable from "clean" until this
+field existed. `redactPersonalData(...).notExamined` is `['names', 'addresses',
+'health-details']`: «Anne» stays in the example above, because a name cannot be told from
+a word by its shape. **Upgrading:** a consumer that compares the whole result with deep
+equality sees one new field.
+
 - **CPR**: `ddmmyy-xxxx` and `ddmmyyxxxx`, only on a real date. The century
   comes from the 7th digit, so `290200-4xxx` (2000) matches and `290200-1xxx`
   (1900) does not. There is no modulus-11 check, because CPR numbers issued