Scan unpacked values, binary artifacts, and generated text for sensitive-looking values

Reads all artifacts that would be copied into a bundle (captured input RDS files, original_result.rds, original_error.rds, hidden_state.rds, user-added RDS/RData files, and textual/dotfile artifacts) from an unpack_call() result and reports strings that match common secret-shaped patterns or values held under credential-named fields. Unreadable or unsupported binary artifacts produce an explicit unknown/unassessed outcome. Reported previews are redacted and never include the full matched value. RDS and RData files are deserialized and recursively inspected; other artifacts up to 1 MiB are treated as UTF-8 text when their initial bytes contain no NUL, while oversized, binary, or unreadable artifacts are unknown. Shape-based detection uses secret_patterns(); credential-named fields are also checked for values without a recognizable shape.

Usage

scan_secrets(x)

Arguments

x

An insider_unpack object returned by unpack_call().

Value

An object of class insider_secret_scan containing flagged (detected secrets), unknown (unassessed or unreadable artifacts), and note.

Examples

if (FALSE) { # \dontrun{
scan_secrets(unpacked)
} # }