Function lensSecrets

hooks_src/quality-gate.js:496–540

(file, content)

  const freq = new Map();
  for (const ch of value) freq.set(ch, (freq.get(ch) || 0) + 1);
  let bits = 0;
  for (const count of freq.values()) {
    const p = count / value.length;
    bits -= p * Math.log2(p);
  }
  return bits;
}

function lensSecrets(file, content) {
  // Defense in depth: docs describing token formats must never block.
  if (/\.md$/.test(file)) return [];

  const violations = [];
  const seenClasses = new Set();

  for (const line of content.split('\n')) {
    if (SECRET_PLACEHOLDER_HINT.test(line)) continue;

    for (const pattern of SECRET_PATTERNS) {
      if (seenClasses.has(pattern.cls)) continue;
      if (pattern.regex.test(line)) {
        seenClasses.add(pattern.cls);
        violations.push({
          file,
          lens: 'secrets',
          rule: pattern.cls,
          message: `Possible ${pattern.label} (class: ${pattern.cls}) - move it to environment configuration and rotate it if real`,
        });
      }
    }

    if (!seenClasses.has('high-entropy-assignment')) {
      const match = SECRET_GENERIC_ASSIGN.exec(line);
      if (match) {
        const value = match[1];
        const looksLikeProse = value.includes(' ');
        if (!looksLikeProse &&
            !SECRET_PLACEHOLDER_HINT.test(value) &&
            shannonEntropy(value) >= SECRET_ENTROPY_THRESHOLD) {
          seenClasses.add('high-entropy-assignment');
          violations.push({
            file,
            lens: 'secrets',
            rule: 'high-entropy-assignment',
            message: 'Secret-like key assigned a high-entropy literal (class: high-entropy-assignment) - load it from environment configuration instead',
          });
        }
      }