Skip to content

Commit b40d0b0

Browse files
SophSoph
authored
Merge pull request #1043 from entireio/soph/switch-to-betterleaks
Switch to betterleaks (again)
2 parents 85fb882 + f0c2ea9 commit b40d0b0

8 files changed

Lines changed: 451 additions & 325 deletions

File tree

‎.allowed-licenses‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,3 +8,4 @@ BSD-3-Clause
88
Apache-2.0
99
MPL-2.0
1010
CC0-1.0
11+
0BSD

‎docs/security-and-privacy.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ If your repository is **public**, this data is visible to the entire internet.
1919
Entire automatically scans transcript and metadata content before writing it to the `entire/checkpoints/v1` branch. Two detection methods run during condensation:
2020

2121
1. **Entropy scoring** — Identifies high-entropy strings (Shannon entropy > 4.5) that look like randomly generated secrets, even if they don't match a known pattern.
22-
2. **Pattern matching** — Uses [gitleaks](https://github.com/gitleaks/gitleaks) built-in rules to detect known secret formats.
22+
2. **Pattern matching** — Uses [Betterleaks](https://github.com/betterleaks/betterleaks) built-in rules to detect known secret formats.
2323

2424
Detected secrets are replaced with `REDACTED` before the data is ever written to a git object. This is **always on** and cannot be disabled.
2525

@@ -35,7 +35,7 @@ If your AI sessions will touch sensitive data:
3535

3636
### Secrets (always on)
3737

38-
Gitleaks pattern matching covers cloud providers (AWS, GCP, Azure), version control platforms (GitHub, GitLab, Bitbucket), payment processors (Stripe, Square), communication tools (Slack, Discord, Twilio), database connection strings, private key blocks (RSA, DSA, EC, PGP), and generic credentials (bearer tokens, basic auth, JWTs). Entropy scoring catches secrets that don't match any known pattern.
38+
Betterleaks pattern matching covers cloud providers (AWS, GCP, Azure), version control platforms (GitHub, GitLab, Bitbucket), payment processors (Stripe, Square), communication tools (Slack, Discord, Twilio), private key blocks (RSA, DSA, EC, PGP), and generic credentials (bearer tokens, basic auth, JWTs). Entire also redacts database connection strings and other credentialed URLs containing `://user:password@host`. Entropy scoring catches secrets that don't match any known pattern.
3939

4040
All detected secrets are replaced with `REDACTED`.
4141

‎go.mod‎

Lines changed: 27 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ module github.com/entireio/cli
33
go 1.26.2
44

55
require (
6+
github.com/betterleaks/betterleaks v1.1.2
67
github.com/charmbracelet/bubbles v0.21.1
78
github.com/charmbracelet/bubbletea v1.3.10
89
github.com/charmbracelet/glamour v0.10.0
@@ -21,7 +22,6 @@ require (
2122
github.com/spf13/pflag v1.0.10
2223
github.com/stretchr/testify v1.11.1
2324
github.com/zalando/go-keyring v0.2.8
24-
github.com/zricethezav/gitleaks/v8 v8.30.1
2525
golang.org/x/crypto v0.50.0
2626
golang.org/x/mod v0.35.0
2727
golang.org/x/sync v0.20.0
@@ -30,21 +30,21 @@ require (
3030
)
3131

3232
require (
33-
dario.cat/mergo v1.0.1 // indirect
33+
cel.dev/expr v0.25.1 // indirect
34+
dario.cat/mergo v1.0.2 // indirect
3435
github.com/BobuSumisu/aho-corasick v1.0.3 // indirect
35-
github.com/Masterminds/goutils v1.1.1 // indirect
36-
github.com/Masterminds/semver/v3 v3.3.0 // indirect
37-
github.com/Masterminds/sprig/v3 v3.3.0 // indirect
36+
github.com/Masterminds/semver/v3 v3.4.0 // indirect
3837
github.com/Microsoft/go-winio v0.6.2 // indirect
3938
github.com/ProtonMail/go-crypto v1.4.1 // indirect
40-
github.com/STARRY-S/zip v0.2.1 // indirect
39+
github.com/STARRY-S/zip v0.2.3 // indirect
4140
github.com/alecthomas/chroma/v2 v2.14.0 // indirect
42-
github.com/andybalholm/brotli v1.1.2-0.20250424173009-453214e765f3 // indirect
41+
github.com/andybalholm/brotli v1.2.0 // indirect
42+
github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
4343
github.com/atotto/clipboard v0.1.4 // indirect
4444
github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
4545
github.com/aymerick/douceur v0.2.0 // indirect
4646
github.com/bodgit/plumbing v1.3.0 // indirect
47-
github.com/bodgit/sevenzip v1.6.0 // indirect
47+
github.com/bodgit/sevenzip v1.6.1 // indirect
4848
github.com/bodgit/windows v1.0.1 // indirect
4949
github.com/catppuccin/go v0.3.0 // indirect
5050
github.com/charmbracelet/colorprofile v0.4.1 // indirect
@@ -60,7 +60,7 @@ require (
6060
github.com/cyphar/filepath-securejoin v0.6.1 // indirect
6161
github.com/danieljoos/wincred v1.2.3 // indirect
6262
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
63-
github.com/dlclark/regexp2 v1.11.0 // indirect
63+
github.com/dlclark/regexp2 v1.11.5 // indirect
6464
github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 // indirect
6565
github.com/dustin/go-humanize v1.0.1 // indirect
6666
github.com/emirpasic/gods v1.18.1 // indirect
@@ -71,20 +71,19 @@ require (
7171
github.com/go-git/gcfg/v2 v2.0.2 // indirect
7272
github.com/go-git/x/plugin/objectsigner/gpg v0.1.0 // indirect
7373
github.com/go-git/x/plugin/objectsigner/ssh v0.1.0 // indirect
74+
github.com/go-sprout/sprout v1.0.3 // indirect
7475
github.com/goccy/go-json v0.10.5 // indirect
7576
github.com/godbus/dbus/v5 v5.2.2 // indirect
77+
github.com/google/cel-go v0.27.0 // indirect
7678
github.com/gorilla/css v1.0.1 // indirect
7779
github.com/h2non/filetype v1.1.3 // indirect
78-
github.com/hashicorp/errwrap v1.1.0 // indirect
79-
github.com/hashicorp/go-multierror v1.1.1 // indirect
8080
github.com/hashicorp/go-version v1.7.0 // indirect
8181
github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
8282
github.com/hashicorp/hcl v1.0.0 // indirect
8383
github.com/hiddeco/sshsig v0.2.0 // indirect
84-
github.com/huandu/xstrings v1.5.0 // indirect
8584
github.com/inconshreveable/mousetrap v1.1.0 // indirect
8685
github.com/kevinburke/ssh_config v1.6.0 // indirect
87-
github.com/klauspost/compress v1.17.11 // indirect
86+
github.com/klauspost/compress v1.18.4 // indirect
8887
github.com/klauspost/cpuid/v2 v2.3.0 // indirect
8988
github.com/klauspost/pgzip v1.2.6 // indirect
9089
github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
@@ -93,46 +92,46 @@ require (
9392
github.com/mattn/go-isatty v0.0.20 // indirect
9493
github.com/mattn/go-localereader v0.0.1 // indirect
9594
github.com/mattn/go-runewidth v0.0.19 // indirect
96-
github.com/mholt/archives v0.1.2 // indirect
95+
github.com/mholt/archives v0.1.5 // indirect
9796
github.com/microcosm-cc/bluemonday v1.0.27 // indirect
98-
github.com/minio/minlz v1.0.0 // indirect
97+
github.com/mikelolasagasti/xz v1.0.1 // indirect
98+
github.com/minio/minlz v1.0.1 // indirect
9999
github.com/mitchellh/copystructure v1.2.0 // indirect
100100
github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
101101
github.com/mitchellh/mapstructure v1.5.0 // indirect
102102
github.com/mitchellh/reflectwalk v1.0.2 // indirect
103103
github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
104104
github.com/muesli/cancelreader v0.2.2 // indirect
105105
github.com/muesli/reflow v0.3.0 // indirect
106-
github.com/nwaples/rardecode/v2 v2.1.0 // indirect
107-
github.com/pelletier/go-toml/v2 v2.2.3 // indirect
108-
github.com/pierrec/lz4/v4 v4.1.21 // indirect
106+
github.com/nwaples/rardecode/v2 v2.2.2 // indirect
107+
github.com/pelletier/go-toml/v2 v2.2.4 // indirect
108+
github.com/pierrec/lz4/v4 v4.1.25 // indirect
109109
github.com/pjbgf/sha1cd v0.5.0 // indirect
110+
github.com/pkoukk/tiktoken-go v0.1.8 // indirect
110111
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
111112
github.com/rivo/uniseg v0.4.7 // indirect
112-
github.com/rogpeppe/go-internal v1.12.0 // indirect
113113
github.com/rs/zerolog v1.33.0 // indirect
114114
github.com/sagikazarmark/locafero v0.7.0 // indirect
115115
github.com/sagikazarmark/slog-shim v0.1.0 // indirect
116-
github.com/shopspring/decimal v1.4.0 // indirect
117-
github.com/sorairolake/lzip-go v0.3.5 // indirect
116+
github.com/sorairolake/lzip-go v0.3.8 // indirect
118117
github.com/sourcegraph/conc v0.3.0 // indirect
119-
github.com/spf13/afero v1.12.0 // indirect
120-
github.com/spf13/cast v1.7.1 // indirect
118+
github.com/spf13/afero v1.15.0 // indirect
119+
github.com/spf13/cast v1.10.0 // indirect
121120
github.com/spf13/viper v1.19.0 // indirect
122121
github.com/subosito/gotenv v1.6.0 // indirect
123-
github.com/tetratelabs/wazero v1.9.0 // indirect
124-
github.com/therootcompany/xz v1.0.1 // indirect
125122
github.com/ulikunitz/xz v0.5.15 // indirect
126-
github.com/wasilibs/go-re2 v1.9.0 // indirect
127-
github.com/wasilibs/wazero-helpers v0.0.0-20240620070341-3dff1577cd52 // indirect
128123
github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
129124
github.com/yuin/goldmark v1.7.8 // indirect
130125
github.com/yuin/goldmark-emoji v1.0.5 // indirect
131126
go.uber.org/multierr v1.11.0 // indirect
132-
go4.org v0.0.0-20230225012048-214862532bf5 // indirect
127+
go.yaml.in/yaml/v3 v3.0.4 // indirect
128+
go4.org v0.0.0-20260112195520-a5071408f32f // indirect
133129
golang.org/x/exp v0.0.0-20250218142911-aa4b98e5adaa // indirect
134130
golang.org/x/net v0.53.0 // indirect
135131
golang.org/x/text v0.36.0 // indirect
132+
google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect
133+
google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b // indirect
134+
google.golang.org/protobuf v1.36.11 // indirect
136135
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
137136
gopkg.in/ini.v1 v1.67.0 // indirect
138137
gopkg.in/yaml.v3 v3.0.1 // indirect

0 commit comments

Comments
 (0)