@glideco/secrets-scan

npm install @glideco/secrets-scan

import { scan } from '@glideco/secrets-scan';

const result = scan(
  'key=AKIAIOSFODNN7EXAMPLE token=ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
);

console.log(result.redactions);
// [
//   { kind: 'aws-access-key', match: 'AKIAIOSFODNN7EXAMPLE', start: 4, end: 24, reason: 'denylist' },
//   { kind: 'github-pat', match: 'ghp_xxxx...', start: 32, end: 69, reason: 'denylist' },
// ]

console.log(result.redacted);
// 'key=[REDACTED:aws-access-key] token=[REDACTED:github-pat]'

import { scan } from '@glideco/secrets-scan';

// Turn off entropy for inputs that are naturally high-entropy
// (e.g. base64-encoded binary payloads, transaction hashes).
const result = scan(txHashHeavyLogLine, { disableEntropy: true });

// Tighten entropy threshold (default 4.5 bits/char, default min length 30).
const strict = scan(inputText, {
  entropyBitsPerChar: 4.8,
  entropyMinLength: 40,
});

import { scan } from '@glideco/secrets-scan';

const result = scan(input, {
  marker: (kind) => `<REDACTED_${kind.toUpperCase()}>`,
});
// → 'prefix <REDACTED_AWS-ACCESS-KEY> suffix'

import { shannonEntropyBitsPerChar } from '@glideco/secrets-scan';

// Inspect the entropy score of a specific string.
const score = shannonEntropyBitsPerChar('sk-ant-api03-abcdef1234567890');
// → ~4.8 (above the 4.5 default threshold)