Function scanFileForValues

packages/varlock/src/cli/commands/scan.command.ts:255–299

(
  filePath: string,
  sensitiveValues: Map<string, string>,
)

 * sensitiveValues is a map from env key name to its resolved string value.
 */
export async function scanFileForValues(
  filePath: string,
  sensitiveValues: Map<string, string>,
): Promise<Array<ScanFinding>> {
  const findings: Array<ScanFinding> = [];
  let content: string;
  try {
    content = await fs.readFile(filePath, 'utf-8');
  } catch {
    return findings;
  }

  // Skip binary files (contain null bytes)
  if (content.includes('\0')) return findings;

  // Quick pre-check: skip the file entirely if none of the values appear
  let anyMatch = false;
  for (const val of sensitiveValues.values()) {
    if (content.includes(val)) {
      anyMatch = true;
      break;
    }
  }
  if (!anyMatch) return findings;

  const lines = content.split('\n');
  for (let i = 0; i < lines.length; i++) {
    const line = lines[i];
    for (const [keyName, val] of sensitiveValues) {
      const colIdx = line.indexOf(val);
      if (colIdx !== -1) {
        findings.push({
          filePath,
          lineNumber: i + 1,
          columnNumber: colIdx + 1,
          line: line.trim(),
          sensitiveKeyName: keyName,
          sensitiveValue: val,
        });
        break; // one finding per line is enough
      }
    }
  }
  return findings;
}

const SCAN_COMMAND = 'varlock scan';