Class: RosettAi::Retrofit::SecretDetector

Inherits:
Object
  • Object
show all
Defined in:
lib/rosett_ai/retrofit/secret_detector.rb

Overview

Detects sensitive values in parsed configuration data and replaces them with $secret:env:NAME references.

Recognises API keys, tokens, passwords, and other secrets by key name patterns and value heuristics (length, entropy, prefixes).

Author:

  • hugo

  • claude

Constant Summary collapse

SENSITIVE_KEY_PATTERNS =

Returns Regex patterns matching sensitive configuration keys.

Returns:

  • (Array) —

    Regex patterns matching sensitive configuration keys.

[
  /api[_-]?key/i,
  /secret/i,
  /token/i,
  /password/i,
  /credential/i,
  /auth/i,
  /private[_-]?key/i
].freeze
SECRET_VALUE_PREFIXES =

Returns String prefixes indicating a secret value.

Returns:

  • (Array) —

    String prefixes indicating a secret value.

['sk-', 'pk-', 'ghp_', 'gho_', 'ghs_', 'github_pat_', 'xoxb-', 'xoxp-'].freeze
MIN_SECRET_LENGTH =

Returns Minimum string length to consider as a potential secret.

Returns:

  • (Integer) —

    Minimum string length to consider as a potential secret.

20

Instance Method Summary collapse

Constructor Details

#initialize(warnings: []) ⇒ SecretDetector

Returns a new instance of SecretDetector.

Parameters:

  • warnings (Array<String>) (defaults to: []) —

    mutable array for warning messages



35
36
37
 
# File 'lib/rosett_ai/retrofit/secret_detector.rb', line 35

def initialize(warnings: [])
  @warnings = warnings
end

Instance Method Details

#redact(data, prefix: '') ⇒ Hash

Scans a hash and replaces sensitive values with secret references.

Parameters:

  • data (Hash) —

    parsed configuration data

  • prefix (String) (defaults to: '') —

    key path prefix for env var naming

Returns:

  • (Hash) —

    data with secrets replaced



44
45
46
47
48
49
 
# File 'lib/rosett_ai/retrofit/secret_detector.rb', line 44

def redact(data, prefix: '')
  data.each_with_object({}) do |(key, value), result|
    full_key = prefix.empty? ? key.to_s : "#{prefix}_#{key}"
    result[key] = redact_value(key.to_s, value, full_key)
  end
end