@vaultcompass/vault-guard-core 1.0.6 → 1.1.1

package/dist/match-fingerprint.js

@@ -22,6 +22,6 @@ function relativeFingerprintKey(file, cwd) {
  */
 function fingerprintForMatch(cwd, fileAbs, m) {
     const relKey = relativeFingerprintKey(fileAbs, cwd);
-    const payload = `${relKey}|${m.type}|${m.line}|${m.column}|${m.matchLength}`;
+    const payload = `${relKey}|${m.type}|${m.line}|${m.offset}|${m.matchLength}`;
     return (0, crypto_1.createHash)('sha256').update(payload, 'utf8').digest('hex');
 }

package/dist/scan-output.d.ts

@@ -33,10 +33,13 @@ export interface JsonOutput {
             type: string;
             severity: string;
             line: number;
+            /** 0-based line-relative column. */
             column: number;
+            /** 0-based absolute UTF-16 offset in the scanned content. */
+            offset: number;
             /** Redacted form, e.g. `sk-a…(37c)`. Never the raw secret. */
             value: string;
-            /** SHA-256 hex of `relPath|type|line|column|matchLength` for baselines (no raw secret). */
+            /** SHA-256 hex of `relPath|type|line|offset|matchLength` for baselines (no raw secret). */
             fingerprint: string;
         }>;
     }>;

package/dist/scan-output.js

@@ -43,6 +43,7 @@ function formatJson(results, opts = {}) {
                 severity: m.severity,
                 line: m.line,
                 column: m.column,
+                offset: m.offset,
                 value: m.value,
                 fingerprint: (0, match_fingerprint_1.fingerprintForMatch)(fpCwd, file, m),
             })),

package/dist/scanners/secret-scanner.js

@@ -30,8 +30,21 @@ const regex_safety_1 = require("../utils/regex-safety");
 const BUILTIN_PATTERNS = new Map([
     // --- AI / ML providers ---
     ['anthropic', { regex: /sk-ant-[a-zA-Z0-9_-]{20,}/g, severity: 'critical' }],
-    ['openai', { regex: /sk-[a-zA-Z0-9]{48}/g, severity: 'critical' }],
-    ['openai-project', { regex: /sk-proj-[a-zA-Z0-9_-]{48,}/g, severity: 'critical' }],
+    // OpenAI key formats. All current keys embed the T3BlbkFJ watermark (base64 "OpenAI").
+    // Specific prefixes are ordered first so they get their own rule title (blast radius differs).
+    // The legacy sk- catch-all uses the watermark + token-boundary so it does not shadow the
+    // prefixed rules and avoids matching short benign identifiers.
+    //
+    // DELIBERATE: we do NOT match the pre-2023 bare `sk-<48 alphanumerics>` format (no watermark).
+    // That pattern fires on any base64/hex blob following `sk-` and floods false positives; the
+    // watermark is the only reliable discriminator, matching the gitleaks/trufflehog consensus.
+    // Do not re-add a bare `sk-[A-Za-z0-9]{N,}` rule without an entropy gate and a bench FP guard.
+    ['openai-project', { regex: /sk-proj-[A-Za-z0-9_-]{20,100}T3BlbkFJ[A-Za-z0-9_-]{20,100}/g, severity: 'critical' }],
+    ['openai-svcacct', { regex: /sk-svcacct-[A-Za-z0-9_-]{20,100}T3BlbkFJ[A-Za-z0-9_-]{20,100}/g, severity: 'critical' }],
+    ['openai-admin', { regex: /sk-admin-[A-Za-z0-9_-]{20,100}T3BlbkFJ[A-Za-z0-9_-]{20,100}/g, severity: 'critical' }],
+    // Legacy user key (sk-<20>T3BlbkFJ<20+>). Token-boundary anchored so benign sk- prefixes
+    // in identifiers (e.g. sk-None-short) don't fire without the watermark present.
+    ['openai', { regex: /(?<![A-Za-z0-9_-])sk-[a-zA-Z0-9]{20}T3BlbkFJ[a-zA-Z0-9]{20,}/g, severity: 'critical' }],
     ['huggingface', { regex: /hf_[a-zA-Z0-9]{34,}/g, severity: 'critical' }],
     ['replicate', { regex: /r8_[a-zA-Z0-9]{32}/g, severity: 'critical' }],
     // --- Payment processors ---
@@ -299,7 +312,8 @@ class SecretScanner {
                     type,
                     value: this.maskValue(fullMatch),
                     line,
-                    column: match.index,
+                    column: match.index - (lineIndex[line - 1] ?? 0),
+                    offset: match.index,
                     matchLength: fullMatch.length,
                     severity,
                 });
@@ -388,15 +402,15 @@ class SecretScanner {
         if (matches.length <= 1)
             return matches;
         // Sort by start offset so we can do a linear sweep.
-        const sorted = [...matches].sort((a, b) => a.column - b.column || a.line - b.line);
+        const sorted = [...matches].sort((a, b) => a.offset - b.offset || a.line - b.line);
         const kept = [];
         for (const candidate of sorted) {
-            const cStart = candidate.column;
+            const cStart = candidate.offset;
             const cEnd = cStart + candidate.matchLength;
             let dominated = false;
             for (let i = kept.length - 1; i >= 0; i--) {
                 const existing = kept[i];
-                const eStart = existing.column;
+                const eStart = existing.offset;
                 const eEnd = eStart + existing.matchLength;
                 // No possible overlap once we've passed the candidate start by more
                 // than the max pattern length (optimisation — safe upper bound: 512).

package/dist/types.d.ts

@@ -5,9 +5,11 @@ export interface SecretMatch {
     value: string;
     /** 1-based line number in the file. */
     line: number;
-    /** 0-based absolute byte offset in the file (used for deduplication). */
+    /** 0-based line-relative UTF-16 column, for CLI/SARIF/editor display. */
     column: number;
-    /** Byte length of the original match (used for SARIF region output). */
+    /** 0-based absolute UTF-16 offset in the scanned content, for dedupe/baselines. */
+    offset: number;
+    /** UTF-16 code-unit length of the original match (used for SARIF region output). */
     matchLength: number;
     severity: 'critical' | 'high' | 'medium' | 'low';
 }

package/dist/utils/scan-file.js

@@ -89,7 +89,7 @@ async function scanTextFileAsync(scanner, filePath, options) {
             const found = scanner.scanContent(slice).map(m => ({
                 ...m,
                 line: lineNo,
-                column: utf16Offset + m.column,
+                offset: utf16Offset + m.offset,
             }));
             raw.push(...found);
             utf16Offset += line.length + 1;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vaultcompass/vault-guard-core",
-  "version": "1.0.6",
+  "version": "1.1.1",
   "description": "Secret-scanning engine: vendor-anchored patterns, entropy gating, baselines, SARIF/JSON, hook helpers.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -34,7 +34,7 @@
   "license": "MIT",
   "devDependencies": {
     "@types/jest": "^30.0.0",
-    "@types/node": "^25.9.1",
+    "@types/node": "^25.9.3",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.11",
     "typescript": "^5.0.0"