Precision tuning
Rank of noise sources, from cheapest to fix.
1. Pick the right gate
| Flag | Effect |
|---|---|
--min-confidence medium |
Drops findings whose validator failed (for example a ghp_ token with a bad checksum, a JWT that does not decode, a PEM that is not a key) |
--min-confidence high |
Keeps only prefix-specific, validated or paired findings. Good for blocking pre-commit hooks |
--fail-on high |
Still reports everything but only exits 1 for high/critical |
--no-entropy |
Removes the generic high-entropy-string rule |
A typical split: pre-commit uses --min-confidence high, CI uses the default and a baseline.
2. Suppress known-safe values
- Single line:
# secretsweep:allow reasonon the same line (any comment syntax; the marker is what matters). For a multi-line PEM, put it on the line containingBEGIN. - Paths:
.secretsweepignore(gitignore syntax). Use for vendored code, fixtures and docs. - Legacy debt:
secretsweep baseline create --history. - Whole rule:
--disable generic-password-assignmentordisabled_rulesin.secretsweep.toml.
3. Tune a rule
Copy the built-in rule into .secretsweep.toml with the same id and adjust it: raise entropy, add allowlist regexes, narrow path_regex.
How false positives are already avoided
- Keywords and prefixes keep rules away from unrelated text.
generic-password-assignmentruns only on config-like files (.env,.ini,.yaml,.json, Dockerfile and so on), ignores placeholders (changeme,${VAR},<password>) and dotted identifiers (request.form.password).- The entropy detector requires an assignment to a credential-like name (
secret,token,password,api_key,auth,credential,private_key,access_key), skips names containinghash,sha,digest,checksum,integrity,etag,commit,uuid, skips UUID-shaped values and lockfiles/minified files, and has separate thresholds for hex (length 32+, entropy 3.0+) and base64-like values (length 20+, entropy 4.0+, must mix letters and digits). - A span already reported by a rule is never reported again by another rule or the entropy detector.
Reading confidence
| Level | Meaning |
|---|---|
| high | Validator passed, paired with its partner, or an unambiguous prefix format |
| medium | Contextual or generic match (password assignment, entropy, bare 32-hex Twilio-style keys) |
| low | Matched the shape but validation failed (bad checksum, undecodable JWT/PEM) |