residoo 0.4.13 → 0.4.14
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +5 -5
- package/package.json +1 -1
- package/src/patterns.js +9 -1
package/README.md
CHANGED
|
@@ -53,12 +53,12 @@ A reproducible benchmark against 8 real competing tools, on a synthetic-but-
|
|
|
53
53
|
pattern-true corpus (72 Claude Code sessions, 45 planted credentials, zero
|
|
54
54
|
real secrets), with live egress monitoring so "no network calls" is
|
|
55
55
|
observed, not just documented. Re-run against every meaningful release,
|
|
56
|
-
most recently v0.4.
|
|
56
|
+
most recently v0.4.14:
|
|
57
57
|
|
|
58
58
|
| | residoo | best of the rest |
|
|
59
59
|
|---|---|---|
|
|
60
|
-
| Distinct credentials found (all claimed classes) | **
|
|
61
|
-
| Precision (false positives) | **100%** (0 of
|
|
60
|
+
| Distinct credentials found (all claimed classes) | **45/45 (100%)** | agentsweep 33/42 (79%) |
|
|
61
|
+
| Precision (false positives) | **100%** (0 of 55 flags wrong) | gitleaks, whatileaked, trufflehog also 100% |
|
|
62
62
|
| Network egress during the scan | **none-observed** | 3 of 8 tools attempt real outbound calls in their *default* mode (trufflehog: 50 connection attempts to github.com, slack.com, api.anthropic.com, gitlab.com, npmjs.org) |
|
|
63
63
|
|
|
64
64
|
No single blended score, on purpose: a blend would hide exactly the class-
|
|
@@ -285,7 +285,7 @@ As a GitHub Action (this repo doubles as a composite action):
|
|
|
285
285
|
```yaml
|
|
286
286
|
steps:
|
|
287
287
|
- uses: actions/checkout@v4
|
|
288
|
-
- uses: dandovdub/residoo@v0.4.
|
|
288
|
+
- uses: dandovdub/residoo@v0.4.14
|
|
289
289
|
```
|
|
290
290
|
|
|
291
291
|
As a pre-commit hook:
|
|
@@ -293,7 +293,7 @@ As a pre-commit hook:
|
|
|
293
293
|
```yaml
|
|
294
294
|
repos:
|
|
295
295
|
- repo: https://github.com/dandovdub/residoo
|
|
296
|
-
rev: v0.4.
|
|
296
|
+
rev: v0.4.14
|
|
297
297
|
hooks:
|
|
298
298
|
- id: residoo
|
|
299
299
|
```
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "residoo",
|
|
3
|
-
"version": "0.4.
|
|
3
|
+
"version": "0.4.14",
|
|
4
4
|
"description": "Find secrets leaking through your AI coding agent's session history. Zero network calls in the scan path, zero dependencies.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"author": "CloudRoam (https://cloudroam.io)",
|
package/src/patterns.js
CHANGED
|
@@ -67,8 +67,16 @@ const PATTERNS = [
|
|
|
67
67
|
re: /\beyJ[A-Za-z0-9_-]{10,2000}\.eyJ[A-Za-z0-9_-]{10,20000}\.[A-Za-z0-9_-]{10,2000}\b/g },
|
|
68
68
|
{ id: "connection_string_with_password", label: "Database connection string with embedded password", confidence: "high",
|
|
69
69
|
re: /\b(postgres(?:ql)?|mysql|mongodb(?:\+srv)?):\/\/[^\s:@\/]{1,255}:[^\s@\/]{3,255}@[^\s\/]{1,255}/g },
|
|
70
|
+
// \b alone missed a real shape: transcript text that embeds a literal
|
|
71
|
+
// newline as a JSON string escape ("\n", two characters: backslash then
|
|
72
|
+
// the letter n) leaves that trailing "n" glued directly to the "A" of
|
|
73
|
+
// "Authorization" with no actual whitespace between them on the scanned
|
|
74
|
+
// line, and \b never fires between two word characters. (?<=\\n) is the
|
|
75
|
+
// fix: it also accepts the position right after a literal "\n" escape as
|
|
76
|
+
// a valid left edge, alongside \b's normal boundary — found via this
|
|
77
|
+
// project's own benchmark (bench/RESULTS.md), not a hypothetical.
|
|
70
78
|
{ id: "bearer_header", label: "Authorization: Bearer header with a real-looking token", confidence: "medium",
|
|
71
|
-
re:
|
|
79
|
+
re: /(?:\b|(?<=\\n))authorization["']?\s*[:=]\s*["']?bearer\s+[A-Za-z0-9._-]{16,1000}/gi },
|
|
72
80
|
{ id: "refresh_token_field", label: "refresh_token field", confidence: "medium",
|
|
73
81
|
re: /"refresh_token"\s*:\s*"[^"\s]{20,4000}"/gi },
|
|
74
82
|
{ id: "access_token_field", label: "access_token field", confidence: "medium",
|