secretlint

Fixes

• gcp: bump node-forge from 1.2.1 to 1.3.0 #243

Bug Fixes

• docker: update Node.js 16 (288230a)
• refactor while loop + RegExp.exec → matchAll (#238) (1276228), closes #236 by @HritikR

Features

• slack: detect xapp- token (#239) (d603165) by @azu

What's Changed

• fix(secretlint-rule-filter-comments): remove unnecessary deps by @azu in https://github.com/secretlint/secretlint/pull/234

Full Changelog: https://github.com/secretlint/secretlint/compare/v5.0.0...v5.0.1

Breaking Changes

• Drop Node.js 12 support (#226) (d05fbe6)

Secretlint@5 require Node.js 14+

Please update secretlint and @secretlint/secretlint-rule-preset-recommend at same time.

Features

• config-loader: improve validation to config (#224) (222555f)
  • It throw error when you have used invalid configuration

Others

• Remove @secretlint/config-validator #224

Full Changelog: https://github.com/secretlint/secretlint/compare/v4.2.1...v5.0.0

This version is just re-publish for v4.2.0

Bug Fixes

• sarif: fix main file path (cf874e4)

Features

• sarif: add @secretlint/secretlint-formatter-sarif (#217) (6cdf303)

For more details, please see https://github.com/secretlint/secretlint#sarif-format-support

Performance Improvements

• introduce turborepo (#215) (7080b05)

Bug Fixes

• secretlint-rule-gcp: update node-forge (#212) (10eae64) by @cm-dyoshikawa

This release only update versions.

Previous release was blocked by npm incident
https://status.npmjs.org/incidents/wy4002vc8ryc

fix #208

Bug Fixes

• config-loader: fix to load secretlint rule on Windows (#206) (74526f4)

Features

• npm: support new npm prefix token #201 #200

npm has a new access token format.
secretlint 4.1.0 has supported the new token format like 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.

• Announcing npm’s new access token format | The GitHub Blog
• About access tokens | npm Docs

Fixes

• github: token length should be 40 https://github.com/secretlint/secretlint/commit/6b41e01801d9fe8d5fb25cd15250efddc36f9787

Features

ESM rule support #187

Secretlint allow to load secretlint rule as ESM(ECMAScript modules).
You can write secretlint rule as ESM.

For more details, pleases see document.

• https://github.com/secretlint/secretlint/blob/master/docs/secretlint-rule.md

Support secretlint-disable directive #96 #195

@secretlint/secretlint-rule-filter-comments support disable comment like secretlint-disable.

This rule is included in @secretlint/secretlint-rule-preset-recommend.

// secretlint-disable -- disable all rules

THIS IS SECRET A
THIS IS SECRET B
THIS IS SECRET C

// secretlint-enable -- enable again

// secretlint-disable-next-line @secretlint/secretlint-rule-secret-alphabet -- disable specific rule in next line
THIS IS SECRET D
THIS IS SECRET E // secretlint-disable-line -- disable current line

If you want to use this directive in shellscript, you can use # secretlint-disable.

# secretlint-disable-next-line
echo "THIS IS SECRET, BUT IT WILL BE IGNORED"

For more details, see https://github.com/secretlint/secretlint/blob/master/docs/configuration.md

Breaking Changes

use export const creator instead of export default #190

Secretlint rule should use named export insteadof default export.
It is caused is thatDynamic Import in CommonJS is broken https://github.com/secretlint/secretlint/issues/190

If you have a secretlint rule, please change following.

- export default creator;
+ export { creator }

Require Node.js 12 and update engines #193

Now, Secretlint requires Node.js 12+
It aims to support ECMAScript modules.

Features

• core: add maskSecrets option (#177) (658db4b)

You can mask output of secretlint with --maskSecrets option.

$ secretlint --maskSecrets .credential

/Users/user/.credential
  1:0  error  [AWSSecretAccessKey] found AWS Secret Access Key: ****************************************  @secretlint/secretlint-rule-preset-recommend > @secretlint/secretlint-rule-aws

✖ 1 problem (1 error, 0 warnings)

It will help you to integrate secretlint with CI like GitLab.

• https://docs.gitlab.com/ee/user/application_security/secret_detection/

Features

• formatter: add "native" table formatter (#169) (6bd7910) by @susam-projects

You can use --format table.

$ secretlint --format table "**/*"

Bug Fixes

• gcp: Fixed typo from CP to GCP (#170) (ceab009)

Features

• privatekey: support non cryptosystem name pattern (#173) (c211103)

🆕 Updated

@secretlint/secretlint-rule-preset-recommend

• Add @secretlint/secretlint-rule-github by default

📝 Docs

• Update husky + lint-staged integration
  • https://github.com/secretlint/secretlint#husky--lint-staged
• Add comparison to GitHub's secret scanning
  • https://github.com/secretlint/secretlint#motivation

New Rules

@secretlint/secretlint-rule-github

• Detect new GitHub Token format
• Authentication token format updates are generally available | GitHub Changelog

Fixes

• secretlint-rule-gcp: bump node-forge from 0.9.1 to 0.10.0 #148

New rules

@secretlint/secretlint-rule-no-homedir

A secretlint rule that disallow to include user's homedir path.

@secretlint/secretlint-rule-pattern

A secretlint rule that checks for RegEx patterns

Created by @PseudoCoding

Fixes

• fix handling for non-ascii file path (#137)

BREAKING CHANGES

• core: changes SecretLintRuleMessageTranslate interface #127

Each rule need to change messages object format.

    AWSAccessKeyID: {
-        en: "found AWS Access Key ID: {{ID}}",
-        ja: "AWS Access Key Id: {{ID}} がみつかりました"
+        en: (props: { ID: string }) => `found AWS Access Key ID: ${props.ID}`,
+        ja: (props: { ID: string }) => `AWS Access Key Id: ${props.ID} がみつかりました`,
    },

It will resolve #119 because, it also remove runtime check for placeholder string.
It introduce static checking for template string instead of dynamic checking.

For more details, see documentation.

New Rules

@secretlint/secretlint-rule-sendgrid

@mtsalenc has created @secretlint/secretlint-rule-sendgrid (#128) (8dcb023)

It check SendGrid API Keys to prevent committing.

Features

• recommended-preset: add @secretlint/secretlint-rule-sendgrid to preset (#131) (0bcbe2e)

Bug Fixes

• tester: sort object be property name (#133) (f684cdf)
• core: change SecretLintRuleMessageTranslate to check statically (03ccff1)

New Collaborators

Add @mtsalenc to collaborators 🎉

Features

secretlint-rule-no-dotenv: add new rule (99959b2) #66 #121

@munierujp has implemented @secretlint/secretlint-rule-no-dotenv that disallow to commit .env because dotenv document describe that

Should I commit my .env file?

No. We strongly recommend against committing your .env file to version control.

-- https://github.com/motdotla/dotenv#should-i-commit-my-env-file

You can tell Secretlint to ignore .env file by .secretlintignore configuration.
For more details .secretlintignore, see following document.

• https://github.com/secretlint/secretlint/blob/master/docs/configuration.md#.secretlintignore

Installation

npm install @secretlint/secretlint-rule-no-dotenv

Usage

Edit .secretlintrc.json

{
    "rules": [
        {
            "id": "@secretlint/secretlint-rule-no-dotenv"
        }
    ]
}