{
  "id": 5723694,
  "title": "Building Dotguard: What Writing Detection Rules Taught Me About Developer Habits",
  "url": "https://urgent.news/2026/09/05/building-dotguard-what-writing-detection-rules-taught-me-about",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-05T05:37:59.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/ke_jia_24bb2f9f84f14f728a/building-dotguard-what-writing-detection-rules-taught-me-about-developer-habits-1i6e"
  },
  "original_language": "en",
  "account": "Writing detection rules for dotguard proved to be more informative than expected. Each rule delved into how developers handle secrets, as the patterns must mirror those found in real-world usage. The cloud provider rule highlighted the extent of infrastructure relying on a single provider. The web-token rule revealed the habit of developers copying full tokens into code for debugging purposes, only to forget about them. The high-entropy rule showed that many teams generate strong keys, assign them weak variable names, and store them in plaintext files. False-positive suppressions taught that detection is a balance between sensitivity and trust, with trust being the more expensive aspect. The success of dotguard lies in its ability to change users' habits, not just detect them. The article chronicles the development process, from the initial problem to the final product, revealing developer habits in the process. The zero-dependency nature of dotguard is a significant advantage in security tools, as it allows for easy auditing and eliminates network calls or telemetry. This design ensures transparency and builds trust, as the scanner reads files, matches patterns, and generates a report without any additional dependencies. By distributing the scanning hook within the repository, the behavior becomes part of the team's workflow, ensuring consistent enforcement even as team members change. False positives are an inevitable part of scanning, and the tool is designed to minimize their impact. Developers are encouraged to budget a minute per finding, verify if it's a real secret, and rotate keys if necessary. The false-positive list itself becomes a valuable artifact, providing insights into the codebase's sensitive areas. The scan itself works by searching for patterns of known secrets, such as cloud provider keys, Git tokens, and payment processor keys, among others. It also checks for high-entropy strings associated with suspicious variable names. The scanner covers various types of files, including environment files, config files, and source code, and provides a clear report of the file, line, and matched pattern, allowing for quick verification by humans.",
  "summary": "Writing the detection rules for dotguard was the part of the project I expected to be mechanical and turned out to be the most informative. Each rule is a small study in how developers actually handle secrets, because the pattern you match has to be the pattern that exists in the wild, and the wild is messier than the documentation. The cloud provider rule taught me how much infrastructure runs…",
  "key_points": [
    "Writing detection rules revealed developer habits in handling secrets",
    "Cloud provider rule exposed reliance on single infrastructure providers",
    "False-positive suppressions taught balance between detection sensitivity and trust"
  ],
  "editors_take": "The development of dotguard reveals that changing detection rules to mirror real-world developer habits can effectively alter those habits, while also highlighting the importance of transparency and trust in security tools.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}