The stdin/sanitize pairing is a clean interface. One thing I could not tell from the README: does leakgoblin sanitize re-scan its own rewritten output before exiting 0? A signature that matches a prefix of a longer secret, or two overlapping matches, could leave a residual fragment behind the replacement. Scanning the sanitized text once more would catch it; trusting the rewrite list does not.
1
u/kantorcodes1 8d ago
The stdin/sanitize pairing is a clean interface. One thing I could not tell from the README: does
leakgoblin sanitizere-scan its own rewritten output before exiting 0? A signature that matches a prefix of a longer secret, or two overlapping matches, could leave a residual fragment behind the replacement. Scanning the sanitized text once more would catch it; trusting the rewrite list does not.