Skip to content

fix(go): drop the keyword-only hardcoded-secret rule - #1007

Merged
duriantaco merged 1 commit into
mainfrom
fix/go-drop-keyword-secret-rule
Oct 15, 2026
Merged

duriantaco merged 1 commit into
mainfrom
fix/go-drop-keyword-secret-rule

Conversation

@duriantaco

Copy link
Copy Markdown
Owner

Summary

  • Remove the Go engine rule that flagged any string containing password/secret/apikey/api_key as a HIGH secret. It flagged Skylos's own rule messages and blocks feat(cli): scan fixes for 4.50, upload consent and skylos feedback #1006's trusted-base scan.
  • Known key-prefix detection (sk-, sk_live_, AKIA, ...; CRITICAL) is unchanged; the symlink test fixtures now use sk- markers.

Tests

cd skylos/engines/go && go test ./internal/analyzer/

🤖 Generated with Claude Code

Any Go string containing password, secret, apikey or api_key was reported as a HIGH secret, including Skylos's own rule messages. Known key prefixes (sk-, sk_live_, AKIA, ...) are still reported as CRITICAL.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@duriantaco
duriantaco merged commit c03633b into main Oct 15, 2026
14 checks passed
@duriantaco
duriantaco deleted the fix/go-drop-keyword-secret-rule branch October 15, 2026 00:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant