TruffleHog: verified false is not a dead secret

The flag depends on the scan that set it

A result names a detector and a place in a repository or image. Verified true means that scan’s check was accepted by the provider. Verified false does not mean one thing in every report. If the job disabled verification, nothing was checked, and false is the unset result. If the job ran verification and the provider refused the candidate, false means it was not accepted at that time.

A verification error, when the record has one, means the check did not finish. That is not the same as a refusal. The note has to say which of the three you are looking at, and the job log is how you know.

The redacted string is not for reuse

Redacted is a shortened form the tool stored so two results can be told apart. It is not a value to paste into a provider, a chat, or a ticket comment. Write “redacted form withheld” unless your secret-handling rule says the shortened form may be stored in the ticket system.

Do not run the candidate yourself to “confirm” the flag. The flag is already the record of the check that the job was allowed to make.

What to file with the flag

File the detector name, the verified flag, the job name, and whether that job’s settings allowed verification. File the repository, file, and commit from the source metadata. File a verification error if one is present. Then write one of: not checked, check did not finish, or not accepted when checked.

Worked case: a whole file of false

The nightly lab scan runs with verification disabled and writes 40 results, every one Verified false. A draft says none of the values are live. The job log shows verification was off, so those flags were not checks.

The note says “not checked,” lists detectors and paths, and does not call them dead. A later scan, approved to verify, returns one result whose check errors on a timeout and several that the provider refuses. The timeout stays “check did not finish.” Only a completed refusal is written as “not accepted when checked.” None of the redacted strings are copied into the ticket.

job: nightly-lab  verification: disabled
DetectorName: GitHub  Verified: false  error: (none)
reading: not checked

job: approved-verify  verification: enabled
DetectorName: GitHub  Verified: false  error: timeout
reading: check did not finish