Scan unpacked values, binary artifacts, and generated text for sensitive-looking values

Reads all artifacts that would be copied into a bundle (captured input RDS files, original_result.rds, original_error.rds, hidden_state.rds, user-added RDS/RData files, and textual/dotfile artifacts) from an unpack_call() result and reports strings that match common secret-shaped patterns or values held under credential-named fields. Unreadable or unsupported binary artifacts produce an explicit unknown/unassessed outcome. Reported previews are redacted and never include the full matched value. RDS and RData files are deserialized and recursively inspected when their contents are supported. Raw vectors, functions, environments, external pointers, and objects exceeding the traversal limits (64 levels or 10,000 nodes) are unassessed; environments are not evaluated to inspect their bindings. Other artifacts up to 1 MiB are treated as UTF-8 text when their initial bytes contain no NUL, while oversized, binary, or unreadable artifacts are unknown. Shape-based detection uses secret_patterns(); credential-named fields are also checked for values without a recognizable shape.

Usage

scan_secrets(x)

Arguments

x

An insider_unpack object returned by unpack_call().

Value

An object of class insider_secret_scan containing flagged (detected secrets), unknown (unassessed or unreadable artifacts), and note.

Examples

if (FALSE) { # \dontrun{
scan_secrets(unpacked)
} # }