gitleaks: the rule id is not the fingerprint

The rule id is the rule

RuleID is the name of the rule that matched. Several findings can carry the same RuleID when the same rule matched in different places. The shared name does not make them one finding.

Opening the rule explains the pattern. It does not list the places. The places are on the findings.

The fingerprint is one finding

The fingerprint is the stable id of one match: that rule, in that place, in that scan’s terms. A second fingerprint is a second match even when RuleID is identical.

If the paste has a RuleID and no fingerprint, write “fingerprint not in the paste.” Do not invent one from the rule name.

What to file

File RuleID and the fingerprint when you cite a finding. A count of findings is a count of fingerprints, not a count of distinct rule names, unless you say you are counting names.

Worked case: one rule, two files

A lab scan reports RuleID generic-api-key twice: fingerprint fp-18 on docs/readme.md and fingerprint fp-44 on scripts/notes.txt. A draft files one finding because the rule id is the same.

The note lists both fingerprints under that rule id. They are two matches. Closing one does not close the other.

Snippet

RuleID: generic-api-key
fingerprint fp-18: docs/readme.md
fingerprint fp-44: scripts/notes.txt
write: one rule, two findings
not: one finding because the rule matches

Diagram

The rule and one finding

The name can repeat. The fingerprint does not.

RuleID

Is. Which rule matched

Can. Appear on many findings

Does not. Collapse those findings

Fingerprint

Is. One finding’s id

A second value. A second match

Missing. Say it was not in the paste

Check yourself

1. Two rows share RuleID generic-api-key and have fingerprints fp-18 and fp-44. How many findings are they?

2. The paste has a RuleID and no fingerprint. What do you write?

3. When is it fair to say “three findings”?