credactor 2.3.2__tar.gz → 2.3.3__tar.gz

credactor-2.3.3/PKG-INFO

@@ -0,0 +1,152 @@
+Metadata-Version: 2.4
+Name: credactor
+Version: 2.3.3
+Summary: Scan and redact hardcoded credentials in source code
+Author: Rx
+License-Expression: Apache-2.0
+Project-URL: Repository, https://github.com/rxb06/Credactor
+Keywords: security,credentials,secrets,scanner,redactor
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: encoding
+Requires-Dist: charset-normalizer>=3.0; extra == "encoding"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == "dev"
+Requires-Dist: ruff>=0.5; extra == "dev"
+Dynamic: license-file
+
+[![PyPI](https://img.shields.io/pypi/v/credactor)](https://pypi.org/project/credactor/)
+[![CI](https://github.com/rxb06/Credactor/actions/workflows/ci.yml/badge.svg)](https://github.com/rxb06/Credactor/actions/workflows/ci.yml)
+[![License](https://img.shields.io/badge/licence-Apache%202.0-blue)](LICENSE)
+
+# Credactor
+
+> **TL;DR:** Detect and redact hardcoded credentials before they hit version control. Regex + entropy + context-aware analysis, SARIF output, pre-commit hooks, parallel scanning, automated redaction.
+
+Credactor scans source code for hardcoded secrets — API keys, tokens, passwords, private keys, connection strings — and replaces them with language-aware environment variable references before they reach version control. It runs as a CLI tool, a pre-commit hook, or in CI pipelines. SARIF output plugs straight into GitHub Code Scanning.
+
+<img width="1280" height="640" alt="credactor" src="https://github.com/user-attachments/assets/f1f94a9c-feea-4b8b-9ea4-81f25f07c4df" />
+
+---
+
+## Why Credactor?
+
+Most secret scanners stop at detection. Credactor redacts in place and replaces credentials with the right env var syntax for each language — `os.environ` in Python, `process.env` in JS, `System.getenv` in Java, and so on. It assigns severity levels so you can triage critical findings first instead of wading through noise.
+
+## Install
+
+```bash
+pip install credactor
+```
+
+From source:
+
+```bash
+git clone https://github.com/rxb06/Credactor.git
+cd Credactor
+pip install -e .
+```
+
+After either method, `credactor` works from any directory.
+
+## Quick Start
+
+> Always run `--dry-run` first and review findings before redacting. False positives are possible — use `# credactor:ignore` or `.credactorignore` to suppress them.
+
+```bash
+# Scan current directory (dry run)
+credactor --dry-run .
+
+# Scan and interactively redact
+credactor .
+
+# Redact everything without prompting
+credactor --fix-all .
+
+# CI mode — exit 1 on findings
+credactor --ci .
+```
+
+### Pre-commit Hook
+
+```yaml
+# .pre-commit-config.yaml
+repos:
+  - repo: https://github.com/rxb06/Credactor
+    rev: v2.3.3
+    hooks:
+      - id: credactor
+```
+
+Or run as a module:
+
+```bash
+python -m credactor .
+```
+
+## Detection
+
+| Category | Examples | Severity |
+|---|---|---|
+| Cloud provider keys | AWS (`AKIA...`), GCP (`AIza...`), Stripe (`sk_live_...`), Slack (`xoxb-...`) | Critical |
+| Platform tokens | GitHub (`ghp_`, `github_pat_`), GitLab (`glpat-`), npm (`npm_`), PyPI (`pypi-`) | Critical |
+| Private keys | PEM blocks (`-----BEGIN RSA PRIVATE KEY-----`) | Critical |
+| JWT tokens | `eyJ...` three-segment tokens | High |
+| Connection strings | `postgresql://user:pass@host`, `mongodb+srv://...`, `redis://...` | High |
+| Variable assignments | `password = "..."`, `api_key = "..."`, `db_password = "..."` | High/Medium |
+| XML attributes | `<add key="Password" value="..." />` | High |
+| High-entropy strings | Hex (32-64 chars), Base64 (60+ chars) | Medium/Low |
+
+## Features
+
+- Entropy-based detection with per-pattern thresholds to cut false positives
+- Interactive or batch redaction — review one-by-one, or `--fix-all`
+- Language-aware replacements (`os.environ`, `process.env`, `System.getenv`, etc.)
+- Git history scanning via `--scan-history`
+- `.bak` backups before any file modification
+- Inline `# credactor:ignore` suppression and `.credactorignore` allowlists
+- Per-repo config via `.credactor.toml`
+- Parallel scanning (8 workers) for large repos
+- SARIF 2.1.0 output with column-level annotations for GitHub Code Scanning
+- `--fail-on-error` to catch files that couldn't be scanned
+
+## Scanned File Types
+
+`.py` `.js` `.ts` `.jsx` `.tsx` `.sh` `.bash` `.env` `.env.*` `.cfg` `.ini` `.toml` `.yaml` `.yml` `.rb` `.go` `.java` `.php` `.cs` `.kt` `.tf` `.hcl` `.conf` `.properties` `.xml`
+
+JSON files are excluded by default (high false-positive rate from API responses). Use `--scan-json` to include them.
+
+## Exit Codes
+
+| Code | Meaning |
+|---|---|
+| `0` | No findings, or all resolved |
+| `1` | Unresolved findings |
+| `2` | Error, or files skipped with `--fail-on-error` |
+
+## Docs
+
+| Document | Description |
+|----------|-------------|
+| [Setup Guide](docs/setup.md) | Installation, configuration, CI/CD integration |
+| [User Guide](docs/user-guide.md) | CLI reference, replacement modes, backup safety |
+| [Examples](docs/examples.md) | Common workflows with output |
+| [Integration](docs/integration.md) | Pre-commit hooks, CI pipelines |
+| [Security](docs/security.md) | Threat model, hardening measures, known limitations |
+| [Changelog](CHANGELOG.md) | Version history |
+| [Contributing](CONTRIBUTING.md) | Development setup, code style, PR process |
+| [Disclaimer](docs/DISCLAIMER.md) | Limitations, safe usage, warranty |
+
+## Licence
+
+Apache 2.0. See [LICENSE](LICENSE).

credactor-2.3.3/README.md

@@ -0,0 +1,125 @@
+[![PyPI](https://img.shields.io/pypi/v/credactor)](https://pypi.org/project/credactor/)
+[![CI](https://github.com/rxb06/Credactor/actions/workflows/ci.yml/badge.svg)](https://github.com/rxb06/Credactor/actions/workflows/ci.yml)
+[![License](https://img.shields.io/badge/licence-Apache%202.0-blue)](LICENSE)
+
+# Credactor
+
+> **TL;DR:** Detect and redact hardcoded credentials before they hit version control. Regex + entropy + context-aware analysis, SARIF output, pre-commit hooks, parallel scanning, automated redaction.
+
+Credactor scans source code for hardcoded secrets — API keys, tokens, passwords, private keys, connection strings — and replaces them with language-aware environment variable references before they reach version control. It runs as a CLI tool, a pre-commit hook, or in CI pipelines. SARIF output plugs straight into GitHub Code Scanning.
+
+<img width="1280" height="640" alt="credactor" src="https://github.com/user-attachments/assets/f1f94a9c-feea-4b8b-9ea4-81f25f07c4df" />
+
+---
+
+## Why Credactor?
+
+Most secret scanners stop at detection. Credactor redacts in place and replaces credentials with the right env var syntax for each language — `os.environ` in Python, `process.env` in JS, `System.getenv` in Java, and so on. It assigns severity levels so you can triage critical findings first instead of wading through noise.
+
+## Install
+
+```bash
+pip install credactor
+```
+
+From source:
+
+```bash
+git clone https://github.com/rxb06/Credactor.git
+cd Credactor
+pip install -e .
+```
+
+After either method, `credactor` works from any directory.
+
+## Quick Start
+
+> Always run `--dry-run` first and review findings before redacting. False positives are possible — use `# credactor:ignore` or `.credactorignore` to suppress them.
+
+```bash
+# Scan current directory (dry run)
+credactor --dry-run .
+
+# Scan and interactively redact
+credactor .
+
+# Redact everything without prompting
+credactor --fix-all .
+
+# CI mode — exit 1 on findings
+credactor --ci .
+```
+
+### Pre-commit Hook
+
+```yaml
+# .pre-commit-config.yaml
+repos:
+  - repo: https://github.com/rxb06/Credactor
+    rev: v2.3.3
+    hooks:
+      - id: credactor
+```
+
+Or run as a module:
+
+```bash
+python -m credactor .
+```
+
+## Detection
+
+| Category | Examples | Severity |
+|---|---|---|
+| Cloud provider keys | AWS (`AKIA...`), GCP (`AIza...`), Stripe (`sk_live_...`), Slack (`xoxb-...`) | Critical |
+| Platform tokens | GitHub (`ghp_`, `github_pat_`), GitLab (`glpat-`), npm (`npm_`), PyPI (`pypi-`) | Critical |
+| Private keys | PEM blocks (`-----BEGIN RSA PRIVATE KEY-----`) | Critical |
+| JWT tokens | `eyJ...` three-segment tokens | High |
+| Connection strings | `postgresql://user:pass@host`, `mongodb+srv://...`, `redis://...` | High |
+| Variable assignments | `password = "..."`, `api_key = "..."`, `db_password = "..."` | High/Medium |
+| XML attributes | `<add key="Password" value="..." />` | High |
+| High-entropy strings | Hex (32-64 chars), Base64 (60+ chars) | Medium/Low |
+
+## Features
+
+- Entropy-based detection with per-pattern thresholds to cut false positives
+- Interactive or batch redaction — review one-by-one, or `--fix-all`
+- Language-aware replacements (`os.environ`, `process.env`, `System.getenv`, etc.)
+- Git history scanning via `--scan-history`
+- `.bak` backups before any file modification
+- Inline `# credactor:ignore` suppression and `.credactorignore` allowlists
+- Per-repo config via `.credactor.toml`
+- Parallel scanning (8 workers) for large repos
+- SARIF 2.1.0 output with column-level annotations for GitHub Code Scanning
+- `--fail-on-error` to catch files that couldn't be scanned
+
+## Scanned File Types
+
+`.py` `.js` `.ts` `.jsx` `.tsx` `.sh` `.bash` `.env` `.env.*` `.cfg` `.ini` `.toml` `.yaml` `.yml` `.rb` `.go` `.java` `.php` `.cs` `.kt` `.tf` `.hcl` `.conf` `.properties` `.xml`
+
+JSON files are excluded by default (high false-positive rate from API responses). Use `--scan-json` to include them.
+
+## Exit Codes
+
+| Code | Meaning |
+|---|---|
+| `0` | No findings, or all resolved |
+| `1` | Unresolved findings |
+| `2` | Error, or files skipped with `--fail-on-error` |
+
+## Docs
+
+| Document | Description |
+|----------|-------------|
+| [Setup Guide](docs/setup.md) | Installation, configuration, CI/CD integration |
+| [User Guide](docs/user-guide.md) | CLI reference, replacement modes, backup safety |
+| [Examples](docs/examples.md) | Common workflows with output |
+| [Integration](docs/integration.md) | Pre-commit hooks, CI pipelines |
+| [Security](docs/security.md) | Threat model, hardening measures, known limitations |
+| [Changelog](CHANGELOG.md) | Version history |
+| [Contributing](CONTRIBUTING.md) | Development setup, code style, PR process |
+| [Disclaimer](docs/DISCLAIMER.md) | Limitations, safe usage, warranty |
+
+## Licence
+
+Apache 2.0. See [LICENSE](LICENSE).

{credactor-2.3.2 → credactor-2.3.3}/credactor/__init__.py

@@ -1,3 +1,3 @@
 """Credactor — credential redactor for source code."""
 
-__version__ = '2.3.2'
+__version__ = '2.3.3'

{credactor-2.3.2 → credactor-2.3.3}/credactor/config.py

@@ -94,10 +94,22 @@ def load_config_file(
             # Normpath for cross-platform separator normalisation, then
             # append os.sep AFTER normpath to prevent prefix collision.
             _cand = os.path.normpath(str(candidate.resolve()))
-            _root = os.path.normpath(str(project_root))
-            if project_root and not (
-                _cand == _root or _cand.startswith(_root + os.sep)
-            ):
+            _scan = os.path.normpath(str(Path(root).resolve()))
+
+            if project_root:
+                _root = os.path.normpath(str(project_root))
+                outside = not (
+                    _cand == _root or _cand.startswith(_root + os.sep)
+                )
+            else:
+                # SEC-39: No project root found (no .git). Fall back to
+                # checking against the scan root — warn if config is in
+                # a parent directory, since we cannot verify trust.
+                outside = not (
+                    _cand == _scan or _cand.startswith(_scan + os.sep)
+                )
+
+            if outside:
                 if ci_mode:
                     # SEC-29: Hard block in CI — never trust external config
                     print(
@@ -106,9 +118,10 @@ def load_config_file(
                         file=sys.stderr,
                     )
                     return {}
+                ref = project_root or root
                 print(
                     f'[WARN] Config loaded from outside project root: '
-                    f'{candidate} (project root: {project_root})',
+                    f'{candidate} (project root: {ref})',
                     file=sys.stderr,
                 )
             return _parse_toml(candidate)
@@ -173,7 +186,13 @@ def _basic_toml_parse(path: Path) -> dict:
 def apply_config_file(config: Config, file_data: dict) -> None:
     """Merge values from a parsed config file into the Config object."""
     if 'entropy_threshold' in file_data:
-        val = float(file_data['entropy_threshold'])
+        # SEC-38: Guard against type confusion (e.g. array where scalar expected).
+        try:
+            val = float(file_data['entropy_threshold'])
+        except (ValueError, TypeError):
+            print('[WARN] entropy_threshold has invalid type, using default 3.5',
+                  file=sys.stderr)
+            val = 3.5
         # SEC-12: Bound entropy threshold to valid Shannon entropy range
         if not 0.0 <= val <= 6.0:
             print(f'[WARN] entropy_threshold={val} out of valid range (0.0-6.0), '
@@ -181,7 +200,13 @@ def apply_config_file(config: Config, file_data: dict) -> None:
             val = 3.5
         config.entropy_threshold = val
     if 'min_value_length' in file_data:
-        val_i = int(file_data['min_value_length'])
+        # SEC-38: Guard against type confusion.
+        try:
+            val_i = int(file_data['min_value_length'])
+        except (ValueError, TypeError):
+            print('[WARN] min_value_length has invalid type, using default 8',
+                  file=sys.stderr)
+            val_i = 8
         # SEC-12: Bound min_value_length to reasonable range
         if not 1 <= val_i <= 200:
             print(f'[WARN] min_value_length={val_i} out of valid range (1-200), '

{credactor-2.3.2 → credactor-2.3.3}/credactor/report.py

@@ -14,7 +14,7 @@ from pathlib import Path
 from typing import TextIO
 
 from . import __version__
-from .utils import mask_secret
+from .utils import mask_secret, sanitize_for_terminal
 
 # ---------------------------------------------------------------------------
 # ANSI color helpers (#31)
@@ -82,7 +82,10 @@ def print_report(
             rel = Path(filepath).relative_to(root_path)
         except ValueError:
             rel = Path(filepath)
-        print(_c(f'  FILE: {rel}', 'bold', use_color=color), file=stream)
+        # SEC-36: Sanitise file path for terminal output to prevent
+        # escape-sequence injection via crafted filenames.
+        safe_rel = sanitize_for_terminal(str(rel))
+        print(_c(f'  FILE: {safe_rel}', 'bold', use_color=color), file=stream)
         print(f'  {"─" * 60}', file=stream)
         for finding in file_findings:
             severity = finding.get('severity', 'medium')
@@ -91,9 +94,12 @@ def print_report(
             # #2/#29 — mask the credential in the raw line display
             masked_raw = _mask_in_line(finding['raw'], finding['full_value'])
 
+            # SEC-36: Sanitise type and raw line for terminal output.
+            safe_type = sanitize_for_terminal(finding['type'])
+            safe_raw = sanitize_for_terminal(masked_raw[:120])
             sev_label = _c(f'[{severity.upper()}]', sev_color, use_color=color)
-            print(f'  Line {finding["line"]:>4}  {sev_label}  [{finding["type"]}]', file=stream)
-            print(f'           {masked_raw[:120]}', file=stream)
+            print(f'  Line {finding["line"]:>4}  {sev_label}  [{safe_type}]', file=stream)
+            print(f'           {safe_raw}', file=stream)
         print(file=stream)
 
     print(f'{"=" * 70}', file=stream)
@@ -142,13 +148,17 @@ def sarif_report(findings: list[dict], root: str) -> str:
     results = []
 
     for f in findings:
-        rule_id = f['type'].replace(':', '-')
+        # SEC-35: Sanitise finding type for SARIF rule fields.  The type can
+        # contain attacker-controlled content (e.g. xml-attr keys), so escape
+        # HTML to prevent XSS in downstream SARIF viewers.
+        safe_type = html.escape(f['type'])
+        rule_id = safe_type.replace(':', '-')
         if rule_id not in rules:
             rules[rule_id] = {
                 'id': rule_id,
-                'shortDescription': {'text': f['type']},
+                'shortDescription': {'text': safe_type},
                 'fullDescription': {
-                    'text': f'Credactor detected a potential hardcoded credential ({f["type"]})',
+                    'text': f'Credactor detected a potential hardcoded credential ({safe_type})',
                 },
                 'help': {
                     'text': ('Remove the hardcoded credential and use an'

{credactor-2.3.2 → credactor-2.3.3}/credactor/scanner.py

@@ -105,8 +105,15 @@ def _is_safe_value(val: str, extra_safe: set[str] | None = None) -> bool:
     if cleaned.startswith('${') and '}' in cleaned:
         return True
     if cleaned.startswith('$') and not cleaned.startswith('${'):
-        # Bare env var: $VAR or $VAR_NAME — no braces, always safe
-        return True
+        # SEC-37: Bare $VAR — validate that the text after $ begins with a
+        # plausible POSIX env var name ([A-Za-z_][A-Za-z0-9_]*).  Uses
+        # re.match (prefix) rather than fullmatch so that dynamic references
+        # with suffixes ($HOME/.aws/credentials, $TOKEN:prefix, $VAR-suffix)
+        # remain safe while pure non-identifier strings ($+foo, $/path,
+        # $123abc) are correctly rejected.
+        env_name = cleaned[1:]
+        if env_name and re.match(r'[A-Za-z_][A-Za-z0-9_]*', env_name):
+            return True
     if cleaned.startswith('{%') and '%}' in cleaned:
         return True
     if cleaned.startswith('{{') and '}}' in cleaned:

credactor-2.3.3/credactor.egg-info/PKG-INFO

@@ -0,0 +1,152 @@
+Metadata-Version: 2.4
+Name: credactor
+Version: 2.3.3
+Summary: Scan and redact hardcoded credentials in source code
+Author: Rx
+License-Expression: Apache-2.0
+Project-URL: Repository, https://github.com/rxb06/Credactor
+Keywords: security,credentials,secrets,scanner,redactor
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: encoding
+Requires-Dist: charset-normalizer>=3.0; extra == "encoding"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == "dev"
+Requires-Dist: ruff>=0.5; extra == "dev"
+Dynamic: license-file
+
+[![PyPI](https://img.shields.io/pypi/v/credactor)](https://pypi.org/project/credactor/)
+[![CI](https://github.com/rxb06/Credactor/actions/workflows/ci.yml/badge.svg)](https://github.com/rxb06/Credactor/actions/workflows/ci.yml)
+[![License](https://img.shields.io/badge/licence-Apache%202.0-blue)](LICENSE)
+
+# Credactor
+
+> **TL;DR:** Detect and redact hardcoded credentials before they hit version control. Regex + entropy + context-aware analysis, SARIF output, pre-commit hooks, parallel scanning, automated redaction.
+
+Credactor scans source code for hardcoded secrets — API keys, tokens, passwords, private keys, connection strings — and replaces them with language-aware environment variable references before they reach version control. It runs as a CLI tool, a pre-commit hook, or in CI pipelines. SARIF output plugs straight into GitHub Code Scanning.
+
+<img width="1280" height="640" alt="credactor" src="https://github.com/user-attachments/assets/f1f94a9c-feea-4b8b-9ea4-81f25f07c4df" />
+
+---
+
+## Why Credactor?
+
+Most secret scanners stop at detection. Credactor redacts in place and replaces credentials with the right env var syntax for each language — `os.environ` in Python, `process.env` in JS, `System.getenv` in Java, and so on. It assigns severity levels so you can triage critical findings first instead of wading through noise.
+
+## Install
+
+```bash
+pip install credactor
+```
+
+From source:
+
+```bash
+git clone https://github.com/rxb06/Credactor.git
+cd Credactor
+pip install -e .
+```
+
+After either method, `credactor` works from any directory.
+
+## Quick Start
+
+> Always run `--dry-run` first and review findings before redacting. False positives are possible — use `# credactor:ignore` or `.credactorignore` to suppress them.
+
+```bash
+# Scan current directory (dry run)
+credactor --dry-run .
+
+# Scan and interactively redact
+credactor .
+
+# Redact everything without prompting
+credactor --fix-all .
+
+# CI mode — exit 1 on findings
+credactor --ci .
+```
+
+### Pre-commit Hook
+
+```yaml
+# .pre-commit-config.yaml
+repos:
+  - repo: https://github.com/rxb06/Credactor
+    rev: v2.3.3
+    hooks:
+      - id: credactor
+```
+
+Or run as a module:
+
+```bash
+python -m credactor .
+```
+
+## Detection
+
+| Category | Examples | Severity |
+|---|---|---|
+| Cloud provider keys | AWS (`AKIA...`), GCP (`AIza...`), Stripe (`sk_live_...`), Slack (`xoxb-...`) | Critical |
+| Platform tokens | GitHub (`ghp_`, `github_pat_`), GitLab (`glpat-`), npm (`npm_`), PyPI (`pypi-`) | Critical |
+| Private keys | PEM blocks (`-----BEGIN RSA PRIVATE KEY-----`) | Critical |
+| JWT tokens | `eyJ...` three-segment tokens | High |
+| Connection strings | `postgresql://user:pass@host`, `mongodb+srv://...`, `redis://...` | High |
+| Variable assignments | `password = "..."`, `api_key = "..."`, `db_password = "..."` | High/Medium |
+| XML attributes | `<add key="Password" value="..." />` | High |
+| High-entropy strings | Hex (32-64 chars), Base64 (60+ chars) | Medium/Low |
+
+## Features
+
+- Entropy-based detection with per-pattern thresholds to cut false positives
+- Interactive or batch redaction — review one-by-one, or `--fix-all`
+- Language-aware replacements (`os.environ`, `process.env`, `System.getenv`, etc.)
+- Git history scanning via `--scan-history`
+- `.bak` backups before any file modification
+- Inline `# credactor:ignore` suppression and `.credactorignore` allowlists
+- Per-repo config via `.credactor.toml`
+- Parallel scanning (8 workers) for large repos
+- SARIF 2.1.0 output with column-level annotations for GitHub Code Scanning
+- `--fail-on-error` to catch files that couldn't be scanned
+
+## Scanned File Types
+
+`.py` `.js` `.ts` `.jsx` `.tsx` `.sh` `.bash` `.env` `.env.*` `.cfg` `.ini` `.toml` `.yaml` `.yml` `.rb` `.go` `.java` `.php` `.cs` `.kt` `.tf` `.hcl` `.conf` `.properties` `.xml`
+
+JSON files are excluded by default (high false-positive rate from API responses). Use `--scan-json` to include them.
+
+## Exit Codes
+
+| Code | Meaning |
+|---|---|
+| `0` | No findings, or all resolved |
+| `1` | Unresolved findings |
+| `2` | Error, or files skipped with `--fail-on-error` |
+
+## Docs
+
+| Document | Description |
+|----------|-------------|
+| [Setup Guide](docs/setup.md) | Installation, configuration, CI/CD integration |
+| [User Guide](docs/user-guide.md) | CLI reference, replacement modes, backup safety |
+| [Examples](docs/examples.md) | Common workflows with output |
+| [Integration](docs/integration.md) | Pre-commit hooks, CI pipelines |
+| [Security](docs/security.md) | Threat model, hardening measures, known limitations |
+| [Changelog](CHANGELOG.md) | Version history |
+| [Contributing](CONTRIBUTING.md) | Development setup, code style, PR process |
+| [Disclaimer](docs/DISCLAIMER.md) | Limitations, safe usage, warranty |
+
+## Licence
+
+Apache 2.0. See [LICENSE](LICENSE).

{credactor-2.3.2 → credactor-2.3.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "credactor"
-version = "2.3.2"
+version = "2.3.3"
 description = "Scan and redact hardcoded credentials in source code"
 readme = "README.md"
 license = "Apache-2.0"