Tools · Secrets and dependency scanning · 24 / 26
TruffleHog: the redacted field is not the raw value
A redacted field is the masked text the report stored. It is not the original secret, and it is not something you paste into a service to test. Write the mask as a mask, and cite the location instead.
The field is a mask
When the result includes a redacted string, that string is what the report chose to show. Characters were withheld. The mask is evidence that a match was recorded, not a copy of the matched value.
Do not complete the mask from memory or from another system. Putting the raw value into the ticket undoes the redaction.
The location is what you can act on
The file, commit, or other source on the row is where the match was reported. A rotation or a removal, if the team decides on one, is aimed at that location. It is not aimed at typing the mask into a login form. This page does not test a value.
Verified, if present, is a different field. Do not read the mask as that field.
What to file
File the detector name, the redacted field labeled as a mask, and the location. Write “raw value not in this result” when the report did not include it. Do not add a reconstructed secret.
Worked case: a mask pasted as the credential
A lab result shows DetectorName LabToken, redacted field lab-****, and path tmp/notes.txt. A draft pastes lab-**** into a note titled “the key” and tells a teammate to try it.
The note says the redacted field is a mask and the path is tmp/notes.txt. The raw value is not in the result. Nothing is typed into a service. The action, if any, names the file, not the mask.
DetectorName: LabToken redacted field: lab-**** path: tmp/notes.txt raw value: not in this result write: mask and path not: try lab-****
Diagram
What the redacted field is allowed to do
It shows that a match was masked. It is not the secret.
- Redacted field
The mask the report stored. Quote it as a mask.
- Raw value
Not in the result. Do not reconstruct it.
- Location
The file or commit you can point a human at.
- A login form
Not a place for the mask. This page does not test values.
Check yourself
1. The result shows redacted field lab-****. What is that string?
2. A teammate wants to try the mask in a service. What belongs in the note instead?
3. The raw value is not in the JSON. What do you add from memory?