Secret Scanner False Positives From Whitespace Stripping
A secret scanner has to catch keys that a line break has cut in two. The fast way to do that is to delete every whitespace character and run the key patterns on what is left. The catch is that deleting whitespace also glues the end of one word to the start of the next. A clean document can then look like it leaks a credential. This post is for anyone who maintains a secret scanner, a data loss…
A secret scanner struggles with API key matches caused by stripping whitespace. The scanner checks text for credentials, looking for patterns like sk- followed by letters and digits. When a line break splits a key in two, the scanner may falsely identify a match. The fix keeps the stripped match but verifies it against the original text.
The scanner maps each character back to its position in the original source before removing whitespace. It then re-runs a pattern on the original span, joining whitespace runs that contain line breaks or Unicode line separators. Finally, the scanner decides whether to accept or reject the match based on the joined source and the position of the match.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
