deepsecrets 2.1.1__tar.gz → 2.2.0__tar.gz

{deepsecrets-2.1.1 → deepsecrets-2.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: deepsecrets
-Version: 2.1.1
+Version: 2.2.0
 Summary: A better tool for secrets scanning
 License: MIT
 License-File: LICENSE
@@ -9,7 +9,7 @@ Author: Nikolai Khechumov
 Author-email: khechumov@gmail.com
 Maintainer: Nikolai Khechumov
 Maintainer-email: khechumov@gmail.com
-Requires-Python: >=3.10,<4.0.0
+Requires-Python: >=3.11,<4.0.0
 Classifier: Programming Language :: Python :: 3
 Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: OS Independent
@@ -17,7 +17,6 @@ Classifier: Environment :: Console
 Classifier: Topic :: Security
 Requires-Dist: aenum (==3.1.17)
 Requires-Dist: jschema-to-python (==1.2.3)
-Requires-Dist: jsx-lexer (==2.0.1)
 Requires-Dist: mmh3 (==5.3.0)
 Requires-Dist: ordered-set (==4.1.0)
 Requires-Dist: puppetparser (==0.2.14)
@@ -79,6 +78,8 @@ From PyPi
 $ pip install deepsecrets
 ```
 
+DeepSecrets needs Python 3.11 or later.
+
 
 ## Scanning
 The easiest way to run a scan:
@@ -98,7 +99,14 @@ The `--help` command is always ready to guide you, but here are the key flags yo
 * `--regex-rules /path/to/rules.json`: Supply your own custom regex ruleset.
 * `--hashed-values /path/to/hashes.json`: Provide a list of pre-hashed known production secrets to search for them securely.
 * `--excluded-paths /path/to/exclusions.json`: Override or extend the default paths ignored during scanning.
+* `--deep-max-size BYTES`: Files larger than this (default 250,000 bytes) get the fast analysis: the regex rules and the variable search, without the language lexer. Big files are mostly generated or minified, the lexer costs most of the scan time on them and rarely finds more there. `0` gives every file the full analysis.
+* `--skip-bundles`: Skip minified JavaScript, source maps and bundles (`*.min.js`, `*.map`, `*.bundle.js`) entirely, on top of the other path exclusions.
+* `--confidence-level {all,low,medium,high,very-high}`: The lowest confidence to report (default `low`, every finding). `medium`, `high` and `very-high` keep confidence 3, 6 and 9 or more; `all` also reports the regex matches the scanner judged not to be secrets (placeholders, examples), with an `-INFO` rule id.
+* `--report-diagnostics`: Add every file found under the target to the SARIF report, with its status, scan time, skip reason and analysis depth.
+* `--regex-candidate-scoring-rules /path/to/rules.json`: Supply your own rules for judging regex matches before they are reported. Give the flag no value to report regex matches unjudged.
+* `--multiprocessing-context {forkserver,spawn,fork}`: How worker processes start. The default is `forkserver` where the platform has it (Linux, macOS): workers share the scanner already loaded in a server process. Windows uses `spawn`. All three give the same findings.
 * `--disable-masking`: Keep potential secrets unmasked in the output report *(see caution below)*.
+* `--ci` / `--no-ci`: Turn CI mode on or off. CI mode prints a plain progress line every 30 seconds instead of the live progress display. It turns on by itself inside CI services (GitHub Actions, GitLab CI, Jenkins and others) and whenever the output is not a terminal.
 
 
 ### Github Actions Integration
@@ -147,7 +155,7 @@ Masking doesn't break the deduplication logic of downstream platforms (like Gith
 
 Every finding gets a confidence score. However, different security platforms parse SARIF metrics differently. To ensure compatibility across modern ASPM dashboards, DeepSecrets does the following:
 
-* **Virtual Subrules (`rules[]`)**: Dynamically generates rules like `S105-LOW` or `S105-CRITICAL`. This forces GitHub Security and DefectDojo to map semantic precision variance properly without breaking native parsers.
+* **Virtual Subrules (`rules[]`)**: Dynamically generates rules by confidence tier, from `S105-LOW` through `-MEDIUM` and `-HIGH` to `S105-VERY-HIGH` (and `-INFO` for the rejected matches `--confidence-level all` reports). This forces GitHub Security and DefectDojo to map semantic precision variance properly without breaking native parsers.
 
 * **Deterministic Result Level**: The tool always explicitly sets `level: error` in the `results[]` model. This acts as a universal fallback for CI/CD pipelines and older SAST parsers, ensuring that exposed secrets reliably break builds or block Pull Requests regardless of individual rule interpretations.
 

{deepsecrets-2.1.1 → deepsecrets-2.2.0}/README.md

@@ -45,6 +45,8 @@ From PyPi
 $ pip install deepsecrets
 ```
 
+DeepSecrets needs Python 3.11 or later.
+
 
 ## Scanning
 The easiest way to run a scan:
@@ -64,7 +66,14 @@ The `--help` command is always ready to guide you, but here are the key flags yo
 * `--regex-rules /path/to/rules.json`: Supply your own custom regex ruleset.
 * `--hashed-values /path/to/hashes.json`: Provide a list of pre-hashed known production secrets to search for them securely.
 * `--excluded-paths /path/to/exclusions.json`: Override or extend the default paths ignored during scanning.
+* `--deep-max-size BYTES`: Files larger than this (default 250,000 bytes) get the fast analysis: the regex rules and the variable search, without the language lexer. Big files are mostly generated or minified, the lexer costs most of the scan time on them and rarely finds more there. `0` gives every file the full analysis.
+* `--skip-bundles`: Skip minified JavaScript, source maps and bundles (`*.min.js`, `*.map`, `*.bundle.js`) entirely, on top of the other path exclusions.
+* `--confidence-level {all,low,medium,high,very-high}`: The lowest confidence to report (default `low`, every finding). `medium`, `high` and `very-high` keep confidence 3, 6 and 9 or more; `all` also reports the regex matches the scanner judged not to be secrets (placeholders, examples), with an `-INFO` rule id.
+* `--report-diagnostics`: Add every file found under the target to the SARIF report, with its status, scan time, skip reason and analysis depth.
+* `--regex-candidate-scoring-rules /path/to/rules.json`: Supply your own rules for judging regex matches before they are reported. Give the flag no value to report regex matches unjudged.
+* `--multiprocessing-context {forkserver,spawn,fork}`: How worker processes start. The default is `forkserver` where the platform has it (Linux, macOS): workers share the scanner already loaded in a server process. Windows uses `spawn`. All three give the same findings.
 * `--disable-masking`: Keep potential secrets unmasked in the output report *(see caution below)*.
+* `--ci` / `--no-ci`: Turn CI mode on or off. CI mode prints a plain progress line every 30 seconds instead of the live progress display. It turns on by itself inside CI services (GitHub Actions, GitLab CI, Jenkins and others) and whenever the output is not a terminal.
 
 
 ### Github Actions Integration
@@ -113,7 +122,7 @@ Masking doesn't break the deduplication logic of downstream platforms (like Gith
 
 Every finding gets a confidence score. However, different security platforms parse SARIF metrics differently. To ensure compatibility across modern ASPM dashboards, DeepSecrets does the following:
 
-* **Virtual Subrules (`rules[]`)**: Dynamically generates rules like `S105-LOW` or `S105-CRITICAL`. This forces GitHub Security and DefectDojo to map semantic precision variance properly without breaking native parsers.
+* **Virtual Subrules (`rules[]`)**: Dynamically generates rules by confidence tier, from `S105-LOW` through `-MEDIUM` and `-HIGH` to `S105-VERY-HIGH` (and `-INFO` for the rejected matches `--confidence-level all` reports). This forces GitHub Security and DefectDojo to map semantic precision variance properly without breaking native parsers.
 
 * **Deterministic Result Level**: The tool always explicitly sets `level: error` in the `results[]` model. This acts as a universal fallback for CI/CD pipelines and older SAST parsers, ensuring that exposed secrets reliably break builds or block Pull Requests regardless of individual rule interpretations.
 

{deepsecrets-2.1.1 → deepsecrets-2.2.0}/deepsecrets/cli.py

@@ -1,27 +1,39 @@
 import argparse
 from datetime import datetime
-import json
+import os
 from argparse import RawTextHelpFormatter
 from typing import Dict, List
 from jschema_to_python.to_json import to_json
+from multiprocessing import get_all_start_methods
 
 from deepsecrets import MODULE_NAME, console
-from deepsecrets.config import SCANNER_VERSION, SCANNER_VERSION_NUMERIC, Config, config, Output
+from deepsecrets.config import (
+    CONFIDENCE_LEVELS,
+    DEFAULT_CONFIDENCE_LEVEL,
+    DEFAULT_DEEP_MAX_SIZE,
+    SCANNER_VERSION,
+    Config,
+    Output,
+)
 from deepsecrets.core.engines.hashed_secret import HashedSecretEngine
 from deepsecrets.core.engines.regex import RegexEngine
 from deepsecrets.core.engines.semantic import SemanticEngine
 from deepsecrets.core.model.finding import Finding
-from deepsecrets.core.model.response.builtin import BuiltinFormatResponseBuilder
 from deepsecrets.core.model.response.dojo_sarif import DojoSarifResponseBuilder
 from deepsecrets.core.rulesets.false_findings import FalseFindingsBuilder
 from deepsecrets.core.rulesets.hashed_secrets import HashedSecretsRulesetBuilder
 from deepsecrets.core.rulesets.regex import RegexRulesetBuilder
+from deepsecrets.core.rulesets.regex_candidate_scoring import RegexCandidateScoringRulesetBuilder
 from deepsecrets.core.rulesets.variable_scoring import VariableScoringRulesetBuilder
 from deepsecrets.core.ui.progress_bar import DSApplicationProgess
 from deepsecrets.core.ui.time_remaining_column import SyncedTimeRemainingColumn
+from deepsecrets.core.utils.exceptions import FileNotFoundException
 from deepsecrets.core.utils.fs import get_abspath, get_path_inside_package
 from deepsecrets.core.utils.log import logger
 from deepsecrets.scan_modes.cli import CliScanMode
+from deepsecrets.core.modes.iscan_mode import WorkerStartupError
+from deepsecrets.core.utils.environment import is_ci_environment
+from deepsecrets.core.utils.multiprocessing_setup import TempDirTooLongError, default_start_method, stop_forkserver
 
 from rich.progress import SpinnerColumn, TextColumn, BarColumn, TaskProgressColumn
 from rich.panel import Panel
@@ -59,6 +71,8 @@ overall_time_column.progress_instance = progress_bar
 
 class DeepSecretsCliTool:
     argparser: argparse.ArgumentParser
+    # built by parse_arguments, one per parse
+    config: Config
 
     def __init__(self, args: List[str]):
         self.args = args
@@ -67,9 +81,6 @@ class DeepSecretsCliTool:
     def say_hello(self) -> None:
         console.line(2)
         console.rule('DeepSecrets', characters='=')
-
-        from rich.panel import Panel
-
         console.print(
             Align(
                 Panel.fit(
@@ -109,11 +120,25 @@ class DeepSecretsCliTool:
             default=['built-in'],
         )
 
+        parser.add_argument(
+            '--regex-candidate-scoring-rules',
+            nargs='*',
+            type=str,
+            help='Controls rules for judging regex matches (candidates) before they are reported: placeholders,\n'
+            'language-like values, hosts, test paths. Used by regex rules that declare an "evidence" class.\n'
+            '- Ignore this argument to use the built-in ruleset\n'
+            "- Using your own rulesets disables the default one. Add 'built-in' to the args list to merge rulesets\n"
+            'eq. --regex-candidate-scoring-rules built-in /root/my_candidate_rules.json\n'
+            '- Give it no value to report regex matches unjudged, as before 2.2\n',
+            default=['built-in'],
+        )
+
         parser.add_argument(
             '--hashed-values',
             nargs='*',
             type=str,
-            help='Path to your Hashed Values set.\n' "Don't set any value to disable this checks\n",
+            help='Path to your Hashed Values set.\n'
+            'Leave the flag out, or give it no value, to disable these checks\n',
         )
 
         parser.add_argument(
@@ -150,6 +175,34 @@ class DeepSecretsCliTool:
             default=['built-in'],
         )
 
+        parser.add_argument(
+            '--skip-bundles',
+            action='store_true',
+            help='Also skip minified JavaScript, source maps and bundles (*.min.js, *.map, *.bundle.js), whatever\n'
+            "--excluded-paths lists (except 'disable'). Most of them are larger than --deep-max-size and get the\n"
+            'fast analysis anyway.\n',
+        )
+
+        parser.add_argument(
+            '--deep-max-size',
+            type=int,
+            default=DEFAULT_DEEP_MAX_SIZE,
+            help='Files larger than this many bytes get the fast analysis: the regex rules and the variable search,\n'
+            'without the language lexer, which costs most of the scan time on big files and rarely finds more there.\n'
+            f'Default: {DEFAULT_DEEP_MAX_SIZE}. 0 gives every file the full analysis.\n',
+        )
+
+        parser.add_argument(
+            '--confidence-level',
+            type=str,
+            default=DEFAULT_CONFIDENCE_LEVEL,
+            choices=list(CONFIDENCE_LEVELS),
+            help='The lowest confidence to report, from all to very-high (default: low).\n'
+            '"low" reports every finding; "medium", "high" and "very-high" keep confidence 3, 6 and 9 or more.\n'
+            '"all" also reports the regex matches the scanner judged not to be secrets (placeholders, examples),\n'
+            'at confidence 0 with an -INFO rule id.\n',
+        )
+
         parser.add_argument(
             '--false-findings',
             nargs='*',
@@ -195,9 +248,20 @@ class DeepSecretsCliTool:
         parser.add_argument(
             '--multiprocessing-context',
             type=str,
-            default='spawn',
-            choices=['fork', 'spawn', 'forkserver'],
-            help='Control the multiprocessing context\n',
+            default=None,
+            # the platform's own: fork and forkserver do not exist on Windows
+            choices=get_all_start_methods(),
+            help='How worker processes start. Default: forkserver where available (Linux, macOS), spawn elsewhere.\n'
+            'forkserver workers share the scanner already loaded in the server instead of loading it again.\n',
+        )
+
+        parser.add_argument(
+            '--ci',
+            action=argparse.BooleanOptionalAction,
+            default=None,
+            help='CI mode: no live progress bars, a plain progress line every 30 s, and no progress manager process.\n'
+            'Default: on inside a CI service (CI, GITHUB_ACTIONS, GITLAB_CI and similar variables) or when the\n'
+            'output is not a terminal; --no-ci forces the live display.\n',
         )
 
         parser.add_argument('--outfile', required=True, type=str)
@@ -208,7 +272,7 @@ class DeepSecretsCliTool:
             choices=['json', 'sarif', 'dojo-sarif'],
             help='"sarif": SARIF format (specification accurate, default)\n'
             '"dojo-sarif": SARIF format (compatible with DefectDojo\'s parser)\n'
-            '"json": old internal format (deprecated and will be removed soon)',
+            '"json": the old internal format, removed in 2.2.0 (exits with an error)',
         )
 
         parser.add_argument(
@@ -222,7 +286,8 @@ class DeepSecretsCliTool:
             '--report-diagnostics',
             action='store_true',
             help='Add scan diagnostics to a SARIF report: every file found under the target directory in\n'
-            'run.artifacts (scan time in ms, status, skip reason) and per-file errors in run.invocations.\n',
+            'run.artifacts (scan time in ms, status, skip reason, analysis depth) and per-file errors in\n'
+            'run.invocations.\n',
         )
 
         parser.add_argument('--benchmarking-mode', help=argparse.SUPPRESS, action='store_true')
@@ -231,17 +296,16 @@ class DeepSecretsCliTool:
         self.argparser = parser
 
     def parse_arguments(self) -> None:
+        # a fresh config for every parse: nothing an earlier run set carries over (KI-CLI-12)
+        config = self.config = Config()
 
         user_args = self.argparser.parse_args(args=self.args[1:])
-        if user_args.verbose:
-            pass
-            # config.set_logging_level(logging.DEBUG)
 
         if user_args.disable_masking:
             config.set_disable_masking(True)
 
-        # set on every parse: the config singleton outlives one run
         config.set_report_diagnostics(user_args.report_diagnostics)
+        config.set_confidence_level(user_args.confidence_level)
 
         if user_args.benchmarking_mode:
             config._set_benchmarking_mode(True)
@@ -251,10 +315,16 @@ class DeepSecretsCliTool:
         config.set_workdir(user_args.target_dir)
         config.set_oneshot_path(user_args.oneshot)
         config.set_max_file_size(user_args.max_file_size)
+        config.set_deep_max_size(user_args.deep_max_size)
         config.set_process_count(user_args.process_count)
-        config.set_mp_context(user_args.multiprocessing_context)
+        config.set_mp_context(user_args.multiprocessing_context or default_start_method())
+        config.set_ci_mode(is_ci_environment() if user_args.ci is None else user_args.ci)
         config.set_verbose(user_args.verbose)
         config.output = Output(type=user_args.outformat, path=user_args.outfile)
+        # checked now, not when the report is written after the whole scan
+        report_dir = os.path.dirname(get_abspath(user_args.outfile))
+        if not os.path.isdir(report_dir):
+            raise FileNotFoundException(f'--outfile: the directory {report_dir} does not exist')
 
         if user_args.reflect_findings_in_return_code:
             config.return_code_if_findings = True
@@ -262,16 +332,24 @@ class DeepSecretsCliTool:
         EXCLUDE_PATHS_BUILTIN = get_path_inside_package('rules/excluded_paths.json')
         if user_args.excluded_paths is not None:
             rules = [rule.replace('built-in', EXCLUDE_PATHS_BUILTIN) for rule in user_args.excluded_paths]
+            if user_args.skip_bundles and 'disable' not in user_args.excluded_paths:
+                rules.append(get_path_inside_package('rules/excluded_bundles.json'))
             config.set_global_exclusion_paths(rules)
 
-        config.engines = []
-
         REGEX_BUILTIN_RULESET = get_path_inside_package('rules/regexes.json')
         if user_args.regex_rules is not None:
             rules = [rule.replace('built-in', REGEX_BUILTIN_RULESET) for rule in user_args.regex_rules]
             config.engines.append(RegexEngine)
             config.add_ruleset(RegexRulesetBuilder, rules)
 
+            CANDIDATE_BUILTIN_RULESET = get_path_inside_package('rules/regex_candidate_scoring_rules.json')
+            if user_args.regex_candidate_scoring_rules is not None:
+                rules = [
+                    rule.replace('built-in', CANDIDATE_BUILTIN_RULESET)
+                    for rule in user_args.regex_candidate_scoring_rules
+                ]
+                config.add_ruleset(RegexCandidateScoringRulesetBuilder, rules)
+
         conf_semantic_analysis = user_args.semantic_analysis
         if conf_semantic_analysis is not None and conf_semantic_analysis != DISABLED:
             config.engines.append(SemanticEngine)
@@ -284,7 +362,9 @@ class DeepSecretsCliTool:
                 config.add_ruleset(VariableScoringRulesetBuilder, rules)
 
         conf_hashed_ruleset = user_args.hashed_values
-        if conf_hashed_ruleset is not None and conf_hashed_ruleset != DISABLED:
+        # the flag without a value disables the check, as its help says; an empty ruleset would only keep the lexer on
+        # every file for nothing (the hashed engine lexes files over --deep-max-size too)
+        if conf_hashed_ruleset and conf_hashed_ruleset != DISABLED:
             config.engines.append(HashedSecretEngine)
             config.add_ruleset(HashedSecretsRulesetBuilder, conf_hashed_ruleset)
 
@@ -293,10 +373,7 @@ class DeepSecretsCliTool:
             config.add_ruleset(FalseFindingsBuilder, conf_false_findings_ruleset)
 
     def get_current_config(self) -> Config:
-        return config
-
-    def _add_ignorefiles(self, files: List[str]):
-        config.set_global_exclusion_paths(files)
+        return self.config
 
     def start(self) -> int:  # pragma: nocover
         startup_time = datetime.now()
@@ -305,52 +382,78 @@ class DeepSecretsCliTool:
         except Exception as e:
             logger.exception(e)
             return ReturnCodes.ERROR
+        config = self.config
 
         if config.output.type == 'json':
-            console.print('\n')
-            if SCANNER_VERSION_NUMERIC[0] == 2 and SCANNER_VERSION_NUMERIC[1] < 2:
-                console.print(
-                    Align(
-                        Panel(
-                            "The internal JSON report format is now DEPRECATED and will be removed in release 2.2.0\n\nConsider switching now.",
-                            padding=(1, 2),
-                            title=Text('SARIF IS NOW DEFAULT OUTPUT FORMAT', style='reverse'),
-                            highlight=True,
-                            subtitle=Text(' --outformat sarif ', style='reverse'),
-                            title_align='center',
-                            width=90,
-                            subtitle_align='center',
-                            box=box.HEAVY,
-                            style='black on orange_red1',
-                            expand=False,
-                        ),
-                        align='center',
-                    )
-                )
-
-            else:
-                console.print(
-                    Align(
-                        Panel(
-                            f"The internal JSON report format was DEPRECATED since the release 2.2.0.\nNow ({SCANNER_VERSION}) it is REMOVED. Switch to SARIF\n.",
-                            padding=(1, 2),
-                            title=Text('SARIF IS NOW DEFAULT OUTPUT FORMAT', style='reverse'),
-                            highlight=True,
-                            subtitle=Text(' --outformat sarif ', style='reverse'),
-                            title_align='center',
-                            width=90,
-                            subtitle_align='center',
-                            box=box.HEAVY,
-                            style='black on orange_red1',
-                            expand=False,
-                        ),
-                        align='center',
-                    )
-                )
-                return ReturnCodes.ERROR
-
-            console.print('\n\n')
+            self._refuse_json_output()
+            return ReturnCodes.ERROR
+
+        self._print_plan()
+
+        try:
+            mode = CliScanMode(config=config)
+        except TempDirTooLongError as e:
+            console.print(f'[bold red][!] Cannot start worker processes: {e}.[/bold red]')
+            return ReturnCodes.ERROR
+
+        console.line()
+
+        if not config.ci_mode:
+            # run() starts it once the worker pool exists
+            mode.set_progress_bar(progress_bar)
+            mode.progress_bar.set_start_time(startup_time)
+
+        try:
+            findings, errors, timings = mode.run()
+        except WorkerStartupError as e:
+            if mode.progress_bar is not None:
+                mode.progress_bar.stop()
+            console.print(f'[bold red][!] Scan stopped: {e}. Every file it took would fail the same way.[/bold red]')
+            self._release(mode)
+            return ReturnCodes.ERROR
+
+        if mode.progress_bar is not None:
+            mode.progress_bar.stop()
+        report_path = get_abspath(config.output.path)
+        self._print_summary(mode, findings, errors, datetime.now() - startup_time, report_path)
+
+        if config._benchmarking_mode is True:
+            return findings, errors, timings, mode._oneshot_file
+
+        self._write_report(mode, findings, report_path)
+        self._say_goodbye(findings)
+        self._release(mode)
+
+        if len(findings) > 0 and config.return_code_if_findings:
+            return ReturnCodes.FINDINGS_DETECTED
+
+        return ReturnCodes.OK
+
+    @staticmethod
+    def _refuse_json_output() -> None:  # pragma: nocover
+        console.print('\n')
+        console.print(
+            Align(
+                Panel(
+                    'The internal JSON report format was deprecated in 2.1 and is removed in 2.2.0.\n'
+                    'Use --outformat sarif (the default) or dojo-sarif.',
+                    padding=(1, 2),
+                    title=Text('SARIF IS NOW DEFAULT OUTPUT FORMAT', style='reverse'),
+                    highlight=True,
+                    subtitle=Text(' --outformat sarif ', style='reverse'),
+                    title_align='center',
+                    width=90,
+                    subtitle_align='center',
+                    box=box.HEAVY,
+                    style='black on orange_red1',
+                    expand=False,
+                ),
+                align='center',
+            )
+        )
 
+    def _print_plan(self) -> None:  # pragma: nocover
+        config = self.config
         console.rule(
             f'Planning a scan against {config.workdir_path} using {config.process_count} process(es)', characters='='
         )
@@ -371,31 +474,9 @@ class DeepSecretsCliTool:
                 f'[bold yellow]:warning:[/bold yellow] The tool will return code of {ReturnCodes.FINDINGS_DETECTED} if any findings are detected\n'
             )
 
-        mode = CliScanMode(config=config)
-
-        console.line()
-
-        mode.set_progress_bar(progress_bar)
-        mode.progress_bar.set_start_time(startup_time)
-        mode.progress_bar.start()
-
-        findings: List[Finding]
-        errors: Dict[str, List[str]]
-        timings: Dict[str, int]
-
-        findings, errors, timings = mode.run()
-
-        '''
-        for finding in findings:
-            if finding._mapped_on_file is False:
-                continue
-            finding.file = None
-        '''
-
-        mode.progress_bar.stop()
-        finish_time = datetime.now()
-        report_path = get_abspath(config.output.path)
-
+    def _print_summary(
+        self, mode: CliScanMode, findings: List[Finding], errors: Dict[str, List[str]], elapsed, report_path: str
+    ) -> None:  # pragma: nocover
         console.line()
         console.print('[bold green]Scanning finished successfully', justify='center')
         console.line()
@@ -416,7 +497,7 @@ class DeepSecretsCliTool:
             Align('Processed Files (Tokens)', vertical='middle'),
             f'{str(len(mode.filepaths))} ({mode.stats.tokens_processed})',
         )
-        table.add_row(Align('Elapsed', vertical='middle'), f'{(finish_time-startup_time).total_seconds():.1f}s')
+        table.add_row(Align('Elapsed', vertical='middle'), f'{elapsed.total_seconds():.1f}s')
         errors_line_color = '[bold red]' if len(errors.keys()) > 0 else '[bold green]'
         table.add_row(
             Align(f'{errors_line_color}File Errors', vertical='middle'),
@@ -429,36 +510,24 @@ class DeepSecretsCliTool:
             Align(f'{findings_line_color}Potential Findings', vertical='middle'),
             f'{findings_line_color}{str(len(findings))}',
         )
-        table.add_row(Align(f'Report Location ({config.output.type})', vertical='middle'), report_path)
+        table.add_row(Align(f'Report Location ({self.config.output.type})', vertical='middle'), report_path)
         console.print(Align(table, align='center'))
 
-        if config._benchmarking_mode is True:
-            return findings, errors, timings, mode._oneshot_file
-
+    def _write_report(self, mode: CliScanMode, findings: List[Finding], report_path: str) -> None:
+        # sarif and dojo-sarif are the same document; built before the file is opened, so a failure leaves no
+        # truncated report behind
+        report = (
+            DojoSarifResponseBuilder()
+            .with_current_mode(mode)
+            .with_findings_list(findings)
+            .with_masking_enabled(not self.config.disable_masking)
+            .build()
+        )
         with open(report_path, 'w+') as f:
+            f.write(to_json(report))
 
-            if config.output.type == 'json':
-                json.dump(
-                    BuiltinFormatResponseBuilder()
-                    .with_current_mode(mode)
-                    .with_findings_list(findings)
-                    .with_masking_enabled(not config.disable_masking)
-                    .build(),
-                    f,
-                )
-
-            if config.output.type in ['sarif', 'dojo-sarif']:
-                f.write(
-                    to_json(
-                        DojoSarifResponseBuilder()
-                        .with_current_mode(mode)
-                        .with_findings_list(findings)
-                        .with_masking_enabled(not config.disable_masking)
-                        .build()
-                    )
-                )
-
-        if len(findings) > 0 and config.disable_masking:
+    def _say_goodbye(self, findings: List[Finding]) -> None:  # pragma: nocover
+        if len(findings) > 0 and self.config.disable_masking:
             console.print(
                 '[bold red]:warning: SECRETS MASKING WAS DISABLED, THE REPORT CONTAINS POTENTIAL SECRETS IN PLAINTEXT.\nBE CAREFUL!',
                 justify='center',
@@ -473,9 +542,10 @@ class DeepSecretsCliTool:
         console.line()
         console.print(Align('[bold green]FINISHED', align='center'))
         console.line(2)
-        mode.dispose()
 
-        if len(findings) > 0 and config.return_code_if_findings:
-            return ReturnCodes.FINDINGS_DETECTED
-
-        return ReturnCodes.OK
+    @staticmethod
+    def _release(mode: CliScanMode) -> None:
+        mode.dispose()
+        # the pool and the manager are gone: wait for the forkserver, so whoever waits for this process sees the
+        # workers' CPU time (KI-CLI-42)
+        stop_forkserver()