Documentation
¶
Overview ¶
Package redacttest is the credential corpus every pattern scanner in cloop is held to: realistic credentials in the context they leak in, and ordinary output that has to come through untouched.
tests/security runs every scanner over every fixture; pkg/redact's own tests run the registry over them. One corpus for both is the point — a scanner can only be said to cover a credential if it is checked against the same text as the others.
Nothing in here is real ¶
Every credential is generated when the corpus is built, from a fixed seed so a failure reproduces, and none appears as a literal in this file. That keeps the source free of strings a push-protection scanner would stop, and it means the shapes are only as realistic as the generators: the GitHub long form is modelled on an installation token measured on 2026-10-03 (ghs_, seven digits, then 36, 254 and 86 characters with the last segment base64url) and revoked the same minute. No real token was ever written down.
Index ¶
Constants ¶
const Seed = 20368
Seed fixes the corpus, so the fixture a failure names is the fixture a rerun produces.
Variables ¶
This section is empty.
Functions ¶
func GitHubLongFormToken ¶
GitHubLongFormToken returns a token in the shape GitHub has issued installation tokens in since September 2026: prefix, seven digits, then 36 and 254 base62 characters and an 86-character base64url tail, joined by "_", "." and ".". 390 characters for a ghs_ prefix.
The tail carries both base64url punctuation characters on purpose, and ends in one when tailEnd is non-zero: a pattern that stops at "-" or demands a final letter would miss exactly those tokens, and a random tail would only sometimes produce them.
Types ¶
type Negative ¶
Negative is ordinary output that looks enough like a credential to tempt a careless pattern, and must be left exactly as it is.
type Positive ¶
type Positive struct {
// Name identifies the fixture in failure messages: "<detector>/<context>".
Name string
// Detector is the registry detector that must report Text. Others may as
// well — a token in an Authorization header is two findings.
Detector string
// Text is the credential in context, as a scanner would receive it.
Text string
// Secrets are the substrings that must not survive redacting Text.
Secrets []string
// Keep are substrings around the credential that must survive it. They are
// what stops a scanner from passing by deleting everything.
Keep []string
}
Positive is a text carrying at least one credential.
Source Files