gitrupt 0.2.0__tar.gz → 0.2.1__tar.gz

{gitrupt-0.2.0 → gitrupt-0.2.1}/CHANGELOG.md

@@ -8,7 +8,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ---
 
 ## [Unreleased]
+## [0.2.1] - 2026-09-17
 
+### Fixed
+
+- **UTF-16 secret detection** — files written as UTF-16 by Windows PowerShell (`>` or `echo`) are now decoded and scanned instead of being skipped as binary. A file created with `'secret' > file.txt` in PowerShell 5.1 is now correctly flagged.
+- **Binary text-file warning** — files with text extensions (`.py`, `.env`, `.json`, `.md`, etc.) that Git classifies as binary now produce a MEDIUM finding. This surfaces encoding issues even when the file would otherwise be skipped by content scanners.
+
+### Added
+
+- `binary-text-file` rule in the forbidden-files scanner.
+
+### Security
+
+- Windows PowerShell developers no longer have a silent bypass path via UTF-16 encoded files.
 ---
 
 ## [0.2.0] - 2026-09-16

{gitrupt-0.2.0 → gitrupt-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitrupt
-Version: 0.2.0
+Version: 0.2.1
 Summary: A local Git security firewall for secrets, suspicious code, malware heuristics, and dependency vulnerability checks
 License: MIT License
         

{gitrupt-0.2.0 → gitrupt-0.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "gitrupt"
-version = "0.2.0"
+version = "0.2.1"
 description = "A local Git security firewall for secrets, suspicious code, malware heuristics, and dependency vulnerability checks"
 readme = "README.md"
 license = { file = "LICENSE" }

{gitrupt-0.2.0 → gitrupt-0.2.1}/src/gitrupt/__init__.py

@@ -4,7 +4,7 @@ Gitrupt — A local Git security firewall.
 Prevents secrets, prohibited files, and threats from entering Git commits.
 """
 
-__version__ = "0.2.0"
+__version__ = "0.2.1"
 __author__ = "Gitrupt Contributors"
 __license__ = "MIT"
 

{gitrupt-0.2.0 → gitrupt-0.2.1}/src/gitrupt/scanners/forbidden_files.py

@@ -2,8 +2,13 @@
 Forbidden file scanner.
 
 Checks staged files against a list of forbidden path patterns.
-Operates on file paths only — no content scanning needed.
+Operates primarily on file paths — no content scanning needed.
 Language-agnostic by construction.
+
+Also flags text-extension files that Git classifies as binary. This often
+means the file was written as UTF-16 (Windows PowerShell does this by
+default) or has been corrupted, and it's a common way for secrets to slip
+past content scanners that skip binary files.
 """
 
 from __future__ import annotations
@@ -46,6 +51,29 @@ DEFAULT_ALLOW_PATTERNS: list[str] = [
     ".env.test",
 ]
 
+# File extensions that indicate text content.
+# If Git classifies one of these as binary, something is wrong —
+# most commonly a UTF-16 encoding written by Windows PowerShell.
+_TEXT_EXTENSIONS: frozenset[str] = frozenset({
+    # Python
+    ".py", ".pyi",
+    # JavaScript / TypeScript
+    ".js", ".mjs", ".cjs", ".ts", ".tsx", ".jsx",
+    # Config / data
+    ".json", ".yaml", ".yml", ".toml", ".ini", ".cfg", ".conf", ".env",
+    # Docs / text
+    ".txt", ".md", ".rst", ".log", ".csv", ".tsv",
+    # Shell
+    ".sh", ".bash", ".zsh", ".fish", ".ps1", ".bat", ".cmd",
+    # Other languages
+    ".rb", ".go", ".rs", ".java", ".kt", ".kts", ".cs", ".php",
+    ".swift", ".c", ".h", ".cpp", ".hpp", ".m", ".mm",
+    # Web
+    ".html", ".htm", ".css", ".scss", ".sass", ".less", ".xml", ".svg",
+    # Misc
+    ".sql", ".gradle", ".properties",
+})
+
 
 class ForbiddenFileScanner(Scanner):
     """
@@ -53,6 +81,9 @@ class ForbiddenFileScanner(Scanner):
 
     Checks file names and paths using glob patterns.
     Does not read file content — purely path-based.
+
+    Additionally, flags any staged file with a text extension that Git
+    classifies as binary, since that often indicates a hidden encoding issue.
     """
 
     def __init__(
@@ -69,7 +100,10 @@ class ForbiddenFileScanner(Scanner):
 
     @property
     def description(self) -> str:
-        return "Detects forbidden file paths (credentials, keys, dangerous executables)"
+        return (
+            "Detects forbidden file paths (credentials, keys, dangerous "
+            "executables) and mis-encoded text files"
+        )
 
     def scan(self, target: ScanTarget) -> list[Finding]:
         findings: list[Finding] = []
@@ -89,7 +123,15 @@ class ForbiddenFileScanner(Scanner):
 
             file_path = staged_file.path
 
-            # Check allow list first
+            # ── Binary text-file check ─────────────────────────────────────
+            # Fires regardless of the allow list — a file can be legitimately
+            # named (e.g. .env.example) and still have a suspicious encoding
+            # that hides content from the secret scanner.
+            binary_finding = self._check_binary_text_file(staged_file)
+            if binary_finding is not None:
+                findings.append(binary_finding)
+
+            # Check allow list — skip path-pattern checks if allowed
             if self._is_allowed(file_path, allow_patterns):
                 logger.debug("File %s is on the allow list, skipping", file_path)
                 continue
@@ -121,6 +163,52 @@ class ForbiddenFileScanner(Scanner):
 
         return findings
 
+    # ── Binary text-file detection ───────────────────────────────────────────
+
+    @staticmethod
+    def _check_binary_text_file(staged_file) -> Finding | None:
+        """
+        Return a Finding if the file has a text extension but is binary.
+
+        Returns None otherwise. Never raises.
+        """
+        if not staged_file.is_binary:
+            return None
+
+        path = staged_file.path
+        basename = PurePosixPath(path).name
+        if "." not in basename:
+            return None
+
+        suffix = "." + basename.rsplit(".", 1)[-1].lower()
+        if suffix not in _TEXT_EXTENSIONS:
+            return None
+
+        return Finding(
+            scanner="forbidden-files",
+            rule_id="binary-text-file",
+            severity=Severity.MEDIUM,
+            confidence=0.7,
+            file=path,
+            line=None,
+            message=f"'{path}' has a text extension but binary content",
+            description=(
+                "Text files should not contain NUL bytes. This usually means "
+                "the file was written as UTF-16 (Windows PowerShell does this "
+                "by default with `>` or `echo`) or has been corrupted. "
+                "Content scanners skip binary files, so a secret in this file "
+                "would not be detected."
+            ),
+            evidence=f"extension={suffix}",
+            recommendation=(
+                "Re-save the file as UTF-8. On Windows PowerShell, use "
+                "`Set-Content -Encoding UTF8` instead of `>` or `echo`."
+            ),
+            can_override=True,
+        )
+
+    # ── Pattern building / matching ──────────────────────────────────────────
+
     def _build_forbidden_patterns(self) -> list[tuple[str, str, Severity]]:
         """Build the complete list of forbidden patterns."""
         patterns = list(DEFAULT_FORBIDDEN_PATTERNS)
@@ -143,7 +231,6 @@ class ForbiddenFileScanner(Scanner):
     @staticmethod
     def _is_allowed(file_path: str, allow_patterns: list[str]) -> bool:
         """Check whether a file path matches any allow pattern."""
-        # Check the full path and just the filename
         basename = PurePosixPath(file_path).name
 
         for pattern in allow_patterns:
@@ -178,7 +265,7 @@ class ForbiddenFileScanner(Scanner):
             # Glob match on basename
             if fnmatch.fnmatch(basename, pattern):
                 return pattern, reason, severity
-            # Glob match on full path (for path-specific rules like "config/secrets/*")
+            # Glob match on full path
             if fnmatch.fnmatch(file_path, pattern):
                 return pattern, reason, severity
             # Also try matching against path components

{gitrupt-0.2.0 → gitrupt-0.2.1}/src/gitrupt/scanners/secrets.py

@@ -2,13 +2,16 @@
 Secret scanner.
 
 Detects secrets in staged file content using:
-    - Curated legacy patterns (SECRET_PATTERNS) — provider-specific, high-specificity
+    - Curated legacy patterns (SECRET_PATTERNS)
     - Private-key block detection (PRIVATE_KEY_RULE)
-    - Provider-specific rules (PROVIDER_RULES) — AI, payments, comms, cloud, tooling
+    - Provider-specific rules (PROVIDER_RULES)
     - Shannon-entropy analysis with context-aware scoring
 
 Works on raw text content — language-agnostic.
 
+Files that Git classifies as binary are decoded if they carry a text BOM
+(UTF-16 LE/BE, UTF-8 with BOM) so PowerShell-generated files still scan.
+
 Secrets are NEVER logged in full. All evidence is redacted.
 """
 
@@ -31,10 +34,7 @@ from gitrupt.scanners.secret_rules import (
 
 logger = logging.getLogger(__name__)
 
-# Maximum file size to scan for secrets (bytes). Large files are skipped.
 MAX_CONTENT_SIZE = 5 * 1024 * 1024  # 5 MB
-
-# Legacy entropy thresholds (kept for backward compatibility with earlier tests)
 ENTROPY_THRESHOLD_HIGH = 4.5
 ENTROPY_THRESHOLD_CRITICAL = 5.0
 
@@ -50,8 +50,6 @@ class SecretPattern:
     confidence: float
     description: str
     recommendation: str
-    # Group index that contains the actual secret value (for redaction).
-    # 0 means use the whole match.
     secret_group: int = 0
 
 
@@ -64,7 +62,6 @@ def _compile(pattern: str) -> re.Pattern[str]:
 # ─────────────────────────────────────────────────────────────────────────────
 
 SECRET_PATTERNS: list[SecretPattern] = [
-    # ── Private Keys ─────────────────────────────────────────────────────────
     SecretPattern(
         rule_id="private-key-pem",
         name="PEM Private Key",
@@ -72,7 +69,7 @@ SECRET_PATTERNS: list[SecretPattern] = [
         severity=Severity.CRITICAL,
         confidence=0.99,
         description="PEM-encoded private key detected in file content",
-        recommendation="Remove the private key and rotate/revoke it immediately. Store keys in a secure vault.",
+        recommendation="Remove the private key and rotate/revoke it immediately.",
         secret_group=0,
     ),
     SecretPattern(
@@ -85,8 +82,6 @@ SECRET_PATTERNS: list[SecretPattern] = [
         recommendation="Remove the private key from this file and use a secrets manager.",
         secret_group=0,
     ),
-
-    # ── AWS Credentials ──────────────────────────────────────────────────────
     SecretPattern(
         rule_id="aws-access-key-id",
         name="AWS Access Key ID",
@@ -110,8 +105,6 @@ SECRET_PATTERNS: list[SecretPattern] = [
         recommendation="Revoke this AWS key immediately. Use IAM roles or environment variables.",
         secret_group=1,
     ),
-
-    # ── GitHub Tokens ────────────────────────────────────────────────────────
     SecretPattern(
         rule_id="github-pat-classic",
         name="GitHub Personal Access Token (Classic)",
@@ -152,8 +145,6 @@ SECRET_PATTERNS: list[SecretPattern] = [
         recommendation="This token is short-lived but should not be committed",
         secret_group=1,
     ),
-
-    # ── Generic API Keys & Tokens ────────────────────────────────────────────
     SecretPattern(
         rule_id="generic-api-key",
         name="Generic API Key",
@@ -167,8 +158,6 @@ SECRET_PATTERNS: list[SecretPattern] = [
         recommendation="Move this value to environment variables or a secrets manager.",
         secret_group=1,
     ),
-
-    # ── Database URLs ────────────────────────────────────────────────────────
     SecretPattern(
         rule_id="database-url-with-password",
         name="Database URL with Password",
@@ -179,11 +168,9 @@ SECRET_PATTERNS: list[SecretPattern] = [
         severity=Severity.CRITICAL,
         confidence=0.92,
         description="Database connection URL with embedded password detected",
-        recommendation="Use environment variables for database credentials. Never hardcode passwords in URLs.",
+        recommendation="Use environment variables for database credentials.",
         secret_group=1,
     ),
-
-    # ── JWT Tokens ───────────────────────────────────────────────────────────
     SecretPattern(
         rule_id="jwt-token",
         name="JWT Token",
@@ -191,11 +178,9 @@ SECRET_PATTERNS: list[SecretPattern] = [
         severity=Severity.HIGH,
         confidence=0.88,
         description="JSON Web Token detected",
-        recommendation="JWT tokens may contain sensitive claims. Do not commit tokens to version control.",
+        recommendation="JWT tokens may contain sensitive claims. Do not commit tokens.",
         secret_group=1,
     ),
-
-    # ── Google Credentials ───────────────────────────────────────────────────
     SecretPattern(
         rule_id="google-api-key",
         name="Google API Key",
@@ -216,8 +201,6 @@ SECRET_PATTERNS: list[SecretPattern] = [
         recommendation="Revoke and rotate the OAuth client secret.",
         secret_group=1,
     ),
-
-    # ── Slack ────────────────────────────────────────────────────────────────
     SecretPattern(
         rule_id="slack-token",
         name="Slack Token",
@@ -238,8 +221,6 @@ SECRET_PATTERNS: list[SecretPattern] = [
         recommendation="Regenerate this webhook URL",
         secret_group=0,
     ),
-
-    # ── Stripe ───────────────────────────────────────────────────────────────
     SecretPattern(
         rule_id="stripe-secret-key",
         name="Stripe Secret Key",
@@ -250,8 +231,6 @@ SECRET_PATTERNS: list[SecretPattern] = [
         recommendation="Revoke this key at dashboard.stripe.com/apikeys",
         secret_group=1,
     ),
-
-    # ── Generic password assignments ────────────────────────────────────────
     SecretPattern(
         rule_id="hardcoded-password",
         name="Hardcoded Password",
@@ -261,12 +240,47 @@ SECRET_PATTERNS: list[SecretPattern] = [
         severity=Severity.HIGH,
         confidence=0.72,
         description="Possible hardcoded password detected",
-        recommendation="Replace hardcoded passwords with environment variables or a secrets manager.",
+        recommendation="Replace hardcoded passwords with environment variables.",
         secret_group=1,
     ),
 ]
 
 
+# ─────────────────────────────────────────────────────────────────────────────
+# UTF-16 / BOM decoding — NEW
+# ─────────────────────────────────────────────────────────────────────────────
+
+
+def _decode_text_with_bom(raw: bytes) -> str | None:
+    """
+    If `raw` starts with a text BOM, decode it as text. Otherwise return None.
+
+    Handles:
+        - UTF-16 LE  (FF FE)
+        - UTF-16 BE  (FE FF)
+        - UTF-8 with BOM (EF BB BF)
+
+    Returns the decoded string, or None if the bytes are not BOM-prefixed text.
+    Never raises.
+    """
+    if not raw or len(raw) < 2:
+        return None
+
+    if raw[:2] in (b"\xff\xfe", b"\xfe\xff"):
+        try:
+            return raw.decode("utf-16")
+        except UnicodeDecodeError:
+            return None
+
+    if len(raw) >= 3 and raw[:3] == b"\xef\xbb\xbf":
+        try:
+            return raw[3:].decode("utf-8")
+        except UnicodeDecodeError:
+            return None
+
+    return None
+
+
 # ─────────────────────────────────────────────────────────────────────────────
 # Scanner
 # ─────────────────────────────────────────────────────────────────────────────
@@ -276,13 +290,14 @@ class SecretScanner(Scanner):
     """
     Scans staged file content for secrets and credentials.
 
-    Four detection passes per added line:
-        1. SECRET_PATTERNS       — curated legacy patterns (specific, low FP)
+    Four detection passes per line:
+        1. SECRET_PATTERNS       — curated legacy patterns
         2. PRIVATE_KEY_RULE      — PEM private-key blocks
-        3. PROVIDER_RULES        — AI providers, payments, comms, cloud, tooling
+        3. PROVIDER_RULES        — AI, payments, comms, cloud, tooling
         4. Entropy               — Shannon entropy with context-aware scoring
 
-    All evidence is redacted before it ever reaches a Finding.
+    Files classified by Git as binary are decoded if they carry a text BOM
+    (PowerShell writes UTF-16 by default), then scanned line-by-line.
     """
 
     @property
@@ -299,8 +314,6 @@ class SecretScanner(Scanner):
         for staged_file in target.staged_files:
             if staged_file.status == "D":
                 continue
-            if staged_file.is_binary:
-                continue
             if staged_file.size_bytes > MAX_CONTENT_SIZE:
                 logger.warning(
                     "Skipping secret scan of %s: file too large (%d bytes)",
@@ -309,134 +322,163 @@ class SecretScanner(Scanner):
                 )
                 continue
 
-            file_findings = self._scan_diff_for_file(
-                target.staged_diff, staged_file.path
+            # ── Binary file path: try BOM decode ────────────────────────────
+            if staged_file.is_binary:
+                decoded = self._try_decode_binary(target, staged_file.path)
+                if decoded is None:
+                    continue
+                findings.extend(
+                    self._scan_text_lines(staged_file.path, decoded)
+                )
+                continue
+
+            # ── Normal text file: scan the diff for added lines ─────────────
+            findings.extend(
+                self._scan_diff_for_file(target.staged_diff, staged_file.path)
             )
-            findings.extend(file_findings)
 
         return findings
 
-    # ── Internals ────────────────────────────────────────────────────────────
+    # ── BOM-decode path ──────────────────────────────────────────────────────
+
+    def _try_decode_binary(self, target: ScanTarget, path: str) -> str | None:
+        """Fetch raw staged bytes; decode if BOM-prefixed text."""
+        from gitrupt.git import GitAdapter
+
+        raw = GitAdapter.get_staged_file_bytes(target.repo_root, path)
+        if not raw:
+            return None
+        return _decode_text_with_bom(raw)
+
+    def _scan_text_lines(self, file_path: str, text: str) -> list[Finding]:
+        """
+        Scan decoded text line-by-line (no diff parsing — we scan every line).
+        """
+        findings: list[Finding] = []
+        seen: set[tuple[str, str]] = set()
+
+        for line_number, line_content in enumerate(text.splitlines(), start=1):
+            findings.extend(
+                self._scan_one_line(file_path, line_number, line_content, seen)
+            )
+
+        return findings
+
+    # ── Diff path ────────────────────────────────────────────────────────────
 
     def _scan_diff_for_file(self, diff: str, file_path: str) -> list[Finding]:
-        """Extract added lines from the diff for a specific file and scan them."""
         added_lines = _extract_added_lines(diff, file_path)
         if not added_lines:
             return []
 
         findings: list[Finding] = []
-        # Dedup key is (rule_id, file_path) — one finding per rule per file,
-        # to avoid flooding when a config file contains many similar values.
         seen: set[tuple[str, str]] = set()
 
         for line_number, line_content in added_lines:
+            findings.extend(
+                self._scan_one_line(file_path, line_number, line_content, seen)
+            )
 
-            # ── Pass 1: curated legacy patterns ─────────────────────────────
-            for sp in SECRET_PATTERNS:
-                match = sp.pattern.search(line_content)
-                if not match:
-                    continue
-
-                key = (sp.rule_id, file_path)
-                if key in seen:
-                    continue
+        return findings
 
-                try:
-                    secret_value = (
-                        match.group(sp.secret_group)
-                        if sp.secret_group > 0
-                        else match.group(0)
-                    )
-                except IndexError:
-                    secret_value = match.group(0)
+    # ── Shared line scanner ──────────────────────────────────────────────────
 
-                seen.add(key)
-                findings.append(
-                    Finding(
-                        scanner=self.name,
-                        rule_id=sp.rule_id,
-                        severity=sp.severity,
-                        confidence=sp.confidence,
-                        file=file_path,
-                        line=line_number,
-                        message=f"{sp.name} detected in {file_path}",
-                        description=sp.description,
-                        evidence=_redact(secret_value),
-                        recommendation=sp.recommendation,
-                        can_override=False,
-                    )
-                )
+    def _scan_one_line(
+        self,
+        file_path: str,
+        line_number: int,
+        line_content: str,
+        seen: set[tuple[str, str]],
+    ) -> list[Finding]:
+        findings: list[Finding] = []
 
-            # ── Pass 2: private-key block ───────────────────────────────────
-            pk_match = PRIVATE_KEY_RULE.pattern.search(line_content)
-            if pk_match:
-                key = (PRIVATE_KEY_RULE.rule_id, file_path)
-                if key not in seen:
-                    seen.add(key)
-                    findings.append(
-                        _rule_to_finding(
-                            PRIVATE_KEY_RULE,
-                            file_path,
-                            line_number,
-                            line_content,
-                            match=pk_match,
-                        )
-                    )
-
-            # ── Pass 3: provider-specific rules ─────────────────────────────
-            for rule in PROVIDER_RULES:
-                match = rule.pattern.search(line_content)
-                if not match:
-                    continue
-                if not _context_ok(line_content, match, rule):
-                    continue
+        # Pass 1 — curated legacy patterns
+        for sp in SECRET_PATTERNS:
+            match = sp.pattern.search(line_content)
+            if not match:
+                continue
+            key = (sp.rule_id, file_path)
+            if key in seen:
+                continue
 
-                key = (rule.rule_id, file_path)
-                if key in seen:
-                    continue
+            try:
+                secret_value = (
+                    match.group(sp.secret_group)
+                    if sp.secret_group > 0
+                    else match.group(0)
+                )
+            except IndexError:
+                secret_value = match.group(0)
+
+            seen.add(key)
+            findings.append(
+                Finding(
+                    scanner=self.name,
+                    rule_id=sp.rule_id,
+                    severity=sp.severity,
+                    confidence=sp.confidence,
+                    file=file_path,
+                    line=line_number,
+                    message=f"{sp.name} detected in {file_path}",
+                    description=sp.description,
+                    evidence=_redact(secret_value),
+                    recommendation=sp.recommendation,
+                    can_override=False,
+                )
+            )
 
+        # Pass 2 — private key block
+        pk_match = PRIVATE_KEY_RULE.pattern.search(line_content)
+        if pk_match:
+            key = (PRIVATE_KEY_RULE.rule_id, file_path)
+            if key not in seen:
                 seen.add(key)
                 findings.append(
-                    _rule_to_finding(
-                        rule,
-                        file_path,
-                        line_number,
-                        line_content,
-                        match=match,
-                    )
+                    _rule_to_finding(PRIVATE_KEY_RULE, file_path, line_number, pk_match)
                 )
 
-            # ── Pass 4: entropy ─────────────────────────────────────────────
-            for hit in find_entropy_secrets(line_content):
-                key = ("generic-high-entropy", file_path)
-                if key in seen:
-                    continue
+        # Pass 3 — provider rules
+        for rule in PROVIDER_RULES:
+            match = rule.pattern.search(line_content)
+            if not match:
+                continue
+            if not _context_ok(line_content, match, rule):
+                continue
+            key = (rule.rule_id, file_path)
+            if key in seen:
+                continue
+            seen.add(key)
+            findings.append(
+                _rule_to_finding(rule, file_path, line_number, match)
+            )
 
-                seen.add(key)
-                findings.append(
-                    Finding(
-                        scanner=self.name,
-                        rule_id="generic-high-entropy",
-                        severity=Severity.MEDIUM,
-                        confidence=(
-                            0.7 if hit.reason == "context-assisted" else 0.55
-                        ),
-                        file=file_path,
-                        line=line_number,
-                        message="High-entropy string — possible secret",
-                        description=(
-                            f"Entropy {hit.entropy:.2f} bits/char ({hit.reason}). "
-                            "May be an unrecognised API key or token."
-                        ),
-                        evidence=_redact(hit.value),
-                        recommendation=(
-                            "Verify whether this is a secret. If it is, move it "
-                            "to an environment variable and add the shape to the "
-                            ".gitrupt.yml allowlist."
-                        ),
-                        can_override=True,
-                    )
+        # Pass 4 — entropy
+        for hit in find_entropy_secrets(line_content):
+            key = ("generic-high-entropy", file_path)
+            if key in seen:
+                continue
+            seen.add(key)
+            findings.append(
+                Finding(
+                    scanner=self.name,
+                    rule_id="generic-high-entropy",
+                    severity=Severity.MEDIUM,
+                    confidence=0.7 if hit.reason == "context-assisted" else 0.55,
+                    file=file_path,
+                    line=line_number,
+                    message="High-entropy string — possible secret",
+                    description=(
+                        f"Entropy {hit.entropy:.2f} bits/char ({hit.reason}). "
+                        "May be an unrecognised API key or token."
+                    ),
+                    evidence=_redact(hit.value),
+                    recommendation=(
+                        "Verify whether this is a secret. If it is, move it to "
+                        "an environment variable and allowlist the shape."
+                    ),
+                    can_override=True,
                 )
+            )
 
         return findings
 
@@ -447,10 +489,6 @@ class SecretScanner(Scanner):
 
 
 def _context_ok(line: str, match: re.Match[str], rule: SecretRule) -> bool:
-    """
-    True if the rule has no context requirement, or if one of its context
-    words appears within CONTEXT_WINDOW characters of the match.
-    """
     if not rule.context_words:
         return True
     start = max(0, match.start() - CONTEXT_WINDOW)
@@ -463,13 +501,9 @@ def _rule_to_finding(
     rule: SecretRule,
     file_path: str,
     line_number: int,
-    line_content: str,
-    match: re.Match[str] | None = None,
+    match: re.Match[str],
 ) -> Finding:
-    """Convert a SecretRule match into a Finding with redacted evidence."""
-    if match is None:
-        match = rule.pattern.search(line_content)
-    raw_value = match.group(0) if match else line_content
+    raw_value = match.group(0)
     return Finding(
         scanner="secrets",
         rule_id=rule.rule_id,
@@ -486,12 +520,6 @@ def _rule_to_finding(
 
 
 def _extract_added_lines(diff: str, file_path: str) -> list[tuple[int, str]]:
-    """
-    Extract lines that were added (starting with '+') for a specific file
-    from a unified diff.
-
-    Returns a list of (line_number, content) tuples.
-    """
     if not diff:
         return []
 
@@ -526,33 +554,22 @@ def _extract_added_lines(diff: str, file_path: str) -> list[tuple[int, str]]:
 
 
 def _redact(secret: str) -> str:
-    """
-    Redact a secret value for safe display.
-
-    Shows the first few characters followed by bullets.
-    Never shows the full value.
-    """
     if not secret:
         return "••••••••"
-
     visible = min(4, len(secret) // 4)
     hidden = len(secret) - visible
     return secret[:visible] + "•" * min(hidden, 20)
 
 
 def shannon_entropy(data: str) -> float:
-    """Calculate the Shannon entropy of a string."""
     if not data:
         return 0.0
-
     freq: dict[str, int] = {}
     for char in data:
         freq[char] = freq.get(char, 0) + 1
-
     entropy = 0.0
     length = len(data)
     for count in freq.values():
         probability = count / length
         entropy -= probability * math.log2(probability)
-
     return entropy

{gitrupt-0.2.0 → gitrupt-0.2.1}/src/gitrupt.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitrupt
-Version: 0.2.0
+Version: 0.2.1
 Summary: A local Git security firewall for secrets, suspicious code, malware heuristics, and dependency vulnerability checks
 License: MIT License