TruffleHog: the source type is where it was found

The type picks the metadata

A result names a detector and a source type. The metadata under that type is where the match was found: a repository file and commit for git, a path for a filesystem, an image reference for a container. Fields from a different source type are not on this result.

Verified true or false, from another lesson, is whether a check ran. It does not change the source type. A verified filesystem result is still a file on disk, not a git object.

Do not translate the place

A path in a filesystem result is that path at scan time. It is not a commit. An image result’s reference is the image that was read. It is not a file in the git repo unless a separate result says so. Write the place in the words of the source type you have.

If the source type was stripped from the paste and only a path remains, write “source type not in the paste” and do not guess git.

What to file

File the detector name, the source type, and the location fields that belong to that type. File the verified flag only with the job’s verification setting, as its own fact. Do not add a commit hash to a filesystem result.

Worked case: a build folder filed as a repository commit

A lab scan of ./build-output returns detector name GitHub, source type filesystem, path dist/config.json. A draft says the secret is in commit a71c0e9 of ops-scripts because that repository had a similar filename last month.

The note quotes filesystem and dist/config.json. There is no commit on this result. The older git result, if it exists, keeps its own source type and its own commit. This ticket does not merge them.

detector: GitHub
source type: filesystem
path: dist/config.json
commit: not on this result
older git result: a different source type, cited separately
not: this path is commit a71c0e9