scan4secrets 2.1.0__tar.gz → 2.1.2__tar.gz

{scan4secrets-2.1.0/scan4secrets.egg-info → scan4secrets-2.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: scan4secrets
-Version: 2.1.0
+Version: 2.1.2
 Summary: DAST + SAST secret scanner with live verification, source-map parsing, and CI-native reporting
 Author: M14R41
 License: MIT
@@ -20,7 +20,6 @@ Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
@@ -28,7 +27,7 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Security
 Classifier: Topic :: Software Development :: Quality Assurance
 Classifier: Topic :: System :: Monitoring
-Requires-Python: >=3.9
+Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: requests>=2.31
@@ -206,7 +205,7 @@ scan4secrets --path . --report sarif json jsonl csv html excel pdf --output repo
 | `excel` | Pivot tables and exec summaries |
 | `pdf` | Compliance evidence packets |
 
-Secrets are **redacted by default** (`abcd****wxyz`). Use `--unsafe-show` only when reports are stored securely.
+Secrets are shown **in full by default** so reports are paste-ready for vendor PoC. Pass `--mask` to redact to `abcd****wxyz` for screenshots or shared transcripts.
 
 ---
 

{scan4secrets-2.1.0 → scan4secrets-2.1.2}/README.md

@@ -157,7 +157,7 @@ scan4secrets --path . --report sarif json jsonl csv html excel pdf --output repo
 | `excel` | Pivot tables and exec summaries |
 | `pdf` | Compliance evidence packets |
 
-Secrets are **redacted by default** (`abcd****wxyz`). Use `--unsafe-show` only when reports are stored securely.
+Secrets are shown **in full by default** so reports are paste-ready for vendor PoC. Pass `--mask` to redact to `abcd****wxyz` for screenshots or shared transcripts.
 
 ---
 

{scan4secrets-2.1.0 → scan4secrets-2.1.2}/pyproject.toml

@@ -4,10 +4,10 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "scan4secrets"
-version = "2.1.0"
+version = "2.1.2"
 description = "DAST + SAST secret scanner with live verification, source-map parsing, and CI-native reporting"
 readme = "README.md"
-requires-python = ">=3.9"
+requires-python = ">=3.10"
 license = { text = "MIT" }
 authors = [{ name = "M14R41" }]
 keywords = ["security", "secrets", "scanner", "sast", "dast", "credentials", "bug-bounty"]
@@ -21,7 +21,6 @@ classifiers = [
   "Operating System :: OS Independent",
   "Programming Language :: Python",
   "Programming Language :: Python :: 3",
-  "Programming Language :: Python :: 3.9",
   "Programming Language :: Python :: 3.10",
   "Programming Language :: Python :: 3.11",
   "Programming Language :: Python :: 3.12",

{scan4secrets-2.1.0 → scan4secrets-2.1.2}/scan4secrets/__init__.py

@@ -1,3 +1,3 @@
 """scan4secrets — DAST + SAST secret scanner."""
 
-__version__ = "2.1.0"
+__version__ = "2.1.2"

{scan4secrets-2.1.0 → scan4secrets-2.1.2}/scan4secrets/cli.py

@@ -80,7 +80,7 @@ def _parser() -> argparse.ArgumentParser:
                      choices=["sarif", "json", "jsonl", "csv", "html", "excel", "pdf"])
     out.add_argument("--output", default="scan4secrets-report",
                      help="output base path (extension added per format)")
-    out.add_argument("--unsafe-show", action="store_true", help="include raw secrets in reports (DANGEROUS)")
+    out.add_argument("--mask", action="store_true", help="redact secret values in output (default: show raw values for vendor PoC)")
 
     log = p.add_argument_group("Logging / CI")
     log.add_argument("--quiet", action="store_true")
@@ -135,7 +135,7 @@ def _print_summary(findings, console: Console):
     console.print(tbl)
 
 
-def _print_findings(findings, console: Console):
+def _print_findings(findings, console: Console, *, mask: bool = False):
     if not findings:
         return
     tbl = Table(box=box.SIMPLE, show_lines=False, header_style="bold")
@@ -143,7 +143,7 @@ def _print_findings(findings, console: Console):
     tbl.add_column("Rule", width=28)
     tbl.add_column("V", width=3, justify="center")
     tbl.add_column("Where", overflow="fold")
-    tbl.add_column("Secret (redacted)", overflow="fold")
+    tbl.add_column("Secret (redacted)" if mask else "Secret", overflow="fold")
     style = {"critical": "bold red", "high": "red", "medium": "yellow", "low": "cyan", "info": "dim"}
     for f in findings:
         vmark = "[green]Y[/green]" if f.verified is True else "[dim]-[/dim]" if f.verified is None else "[dim]n[/dim]"
@@ -152,7 +152,7 @@ def _print_findings(findings, console: Console):
             f.rule_id,
             vmark,
             f"{f.file}:{f.line}",
-            f.secret_redacted,
+            f.secret_redacted if mask else f.secret,
         )
     console.print(tbl)
 
@@ -255,13 +255,13 @@ def main(argv=None) -> int:
         verify_findings(findings, rules, timeout=args.verify_timeout)
 
     if not args.quiet:
-        _print_findings(findings, console)
+        _print_findings(findings, console, mask=args.mask)
         _print_summary(findings, console)
 
     if findings:
         out_base = Path(args.output)
         out_base.parent.mkdir(parents=True, exist_ok=True)
-        written = write_reports(findings, out_base, args.report, unsafe_show=args.unsafe_show)
+        written = write_reports(findings, out_base, args.report, unsafe_show=not args.mask)
         if not args.quiet:
             for fmt, p in written.items():
                 console.print(f"[green]+[/] {fmt.upper():6s} -> {p}")

{scan4secrets-2.1.0 → scan4secrets-2.1.2}/scan4secrets/engine/crawler.py

@@ -18,8 +18,11 @@ from concurrent.futures import ThreadPoolExecutor, as_completed
 from typing import Dict, Iterable, List, Optional, Set, Tuple
 from urllib.parse import urljoin, urlparse, urldefrag
 
+import warnings
 import requests
-from bs4 import BeautifulSoup
+from bs4 import BeautifulSoup, XMLParsedAsHTMLWarning
+
+warnings.filterwarnings("ignore", category=XMLParsedAsHTMLWarning)
 
 try:
     import tldextract
@@ -58,11 +61,34 @@ SKIP_SUFFIXES = (
 )
 
 
+_IPV4_RE = re.compile(r"^\d{1,3}(?:\.\d{1,3}){3}(?::\d+)?(?:/.*)?$")
+_IPV6_RE = re.compile(r"^\[[0-9a-fA-F:]+\](?::\d+)?(?:/.*)?$")
+_HOST_PORT_RE = re.compile(r"^[A-Za-z0-9.\-]+:\d+(?:/.*)?$")
+
+
 def normalize_url(url: str) -> str:
-    url = url.strip()
-    if not url.startswith(("http://", "https://")):
-        url = "https://" + url
-    return url
+    url = url.strip().rstrip("/")
+    if not url:
+        raise ValueError("empty target")
+
+    if url.startswith("://"):
+        url = url[3:]
+
+    lower = url.lower()
+    if lower.startswith(("http://", "https://")):
+        return url
+
+    if lower.startswith(("ftp://", "file://", "ws://", "wss://")):
+        raise ValueError(f"unsupported scheme in target: {url}")
+
+    if "://" in url:
+        raise ValueError(f"unknown scheme in target: {url}")
+
+    if _IPV4_RE.match(url) or _IPV6_RE.match(url) or _HOST_PORT_RE.match(url):
+        scheme = "https" if re.search(r":443(?:/|$)", url) else "http"
+        return f"{scheme}://{url}"
+
+    return "https://" + url
 
 
 def etld_plus_one(host: str) -> str:

{scan4secrets-2.1.0 → scan4secrets-2.1.2/scan4secrets.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: scan4secrets
-Version: 2.1.0
+Version: 2.1.2
 Summary: DAST + SAST secret scanner with live verification, source-map parsing, and CI-native reporting
 Author: M14R41
 License: MIT
@@ -20,7 +20,6 @@ Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
@@ -28,7 +27,7 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Security
 Classifier: Topic :: Software Development :: Quality Assurance
 Classifier: Topic :: System :: Monitoring
-Requires-Python: >=3.9
+Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: requests>=2.31
@@ -206,7 +205,7 @@ scan4secrets --path . --report sarif json jsonl csv html excel pdf --output repo
 | `excel` | Pivot tables and exec summaries |
 | `pdf` | Compliance evidence packets |
 
-Secrets are **redacted by default** (`abcd****wxyz`). Use `--unsafe-show` only when reports are stored securely.
+Secrets are shown **in full by default** so reports are paste-ready for vendor PoC. Pass `--mask` to redact to `abcd****wxyz` for screenshots or shared transcripts.
 
 ---