if.security.secrets.detect — demo findings (synthetic repo)

Black/white:

• Verified: this output is bound to the input fingerprint on the trace page (hashes).
• Not verified: completeness of detection; validity of any token; impact; compliance claims.

Inputs (factual)

• Product ID: if.security.secrets.detect
• Ruleset: builtin.v0.1 (sha256: 3d0745f949e494c0b62823f8c38a03bc8eb1eb33ea08f2b2d9559525c0e62e25)
• Source bundle: source.tgz
• Source sha256: 6a0ea78388a98a09c26265cacd92ff6032e765cb323268c87d4d36e0ad20dcac

Receipt links (public; no login)

https://infrafabric.io/static/trace/n6DSejaslZrB2ciVjLiBCg https://infrafabric.io/static/pack/n6DSejaslZrB2ciVjLiBCg

Summary (factual)

• Files scanned: 4
• Findings: 5
• Findings by rule:
  • aws_access_key_id: 1
  • github_token: 1
  • jwt: 1
  • openai_api_key: 1
  • slack_token: 1

Findings (redacted)

• jwt — jwt.txt:1 — eyJa…cccc — match_sha256=754e2608efb1…
  • Context (redacted): jwt = <REDACTED:jwt:754e2608>
• aws_access_key_id — aws.txt:1 — AKIA…CDE1 — match_sha256=ddcce2d6b9a6…
  • Context (redacted): aws_access_key_id = <REDACTED:aws_access_key_id:ddcce2d6>
• github_token — README.md:8 — ghp_…wxyz — match_sha256=6675cd0c365d…
  • Context (redacted): <REDACTED:github_token:6675cd0c>
• openai_api_key — .env:2 — sk-T…CDEF — match_sha256=8f807246636e…
  • Context (redacted): OPENAI_API_KEY=<REDACTED:openai_api_key:8f807246>
• slack_token — .env:3 — xoxb…GHIJ — match_sha256=e6d535cf78ec…
  • Context (redacted): SLACK_TOKEN=<REDACTED:slack_token:e6d535cf>

Safety note (black/white)

• This demo uses synthetic secrets only. Do not run against real repositories without a safe-handling policy.
• Do not publish raw secret values in outputs, logs, receipts, or review packs.

Raw findings (JSON; redacted)

{
  "created_at": "2026-01-06T03:48:36Z",
  "findings": [
    {
      "context_redacted": "jwt = <REDACTED:jwt:754e2608>",
      "line": 1,
      "match_preview": "eyJa\u2026cccc",
      "match_sha256": "754e2608efb170838febcbe48f5a99218223f1d5fbdabf67342ffd11bd6b2c62",
      "path": "jwt.txt",
      "rule_id": "jwt"
    },
    {
      "context_redacted": "aws_access_key_id = <REDACTED:aws_access_key_id:ddcce2d6>",
      "line": 1,
      "match_preview": "AKIA\u2026CDE1",
      "match_sha256": "ddcce2d6b9a68297d36574c90f77293d9bcadeeba6140a6c988a204b07012095",
      "path": "aws.txt",
      "rule_id": "aws_access_key_id"
    },
    {
      "context_redacted": "<REDACTED:github_token:6675cd0c>",
      "line": 8,
      "match_preview": "ghp_\u2026wxyz",
      "match_sha256": "6675cd0c365d2c7d9027a150ec24850631369632248b4b346210ebdf1a59d6b7",
      "path": "README.md",
      "rule_id": "github_token"
    },
    {
      "context_redacted": "OPENAI_API_KEY=<REDACTED:openai_api_key:8f807246>",
      "line": 2,
      "match_preview": "sk-T\u2026CDEF",
      "match_sha256": "8f807246636ed48aae47f229a132c6c795900c6e62695217b73d5be9eb78fb0b",
      "path": ".env",
      "rule_id": "openai_api_key"
    },
    {
      "context_redacted": "SLACK_TOKEN=<REDACTED:slack_token:e6d535cf>",
      "line": 3,
      "match_preview": "xoxb\u2026GHIJ",
      "match_sha256": "e6d535cf78ec149fe8e6ad21bca9770fb94bd858335be4c78f7c126a60438d71",
      "path": ".env",
      "rule_id": "slack_token"
    }
  ],
  "input": {
    "kind": "file",
    "path": "/root/tmp/if_security_secrets_detect_demo/build/source.tgz",
    "sha256": "6a0ea78388a98a09c26265cacd92ff6032e765cb323268c87d4d36e0ad20dcac"
  },
  "product_id": "if.security.secrets.detect",
  "ruleset": {
    "hash_sha256": "3d0745f949e494c0b62823f8c38a03bc8eb1eb33ea08f2b2d9559525c0e62e25",
    "id": "builtin.v0.1",
    "rule_ids": [
      "aws_access_key_id",
      "github_token",
      "openai_api_key",
      "slack_token",
      "private_key_pem",
      "jwt"
    ]
  },
  "summary": {
    "by_rule": {
      "aws_access_key_id": 1,
      "github_token": 1,
      "jwt": 1,
      "openai_api_key": 1,
      "slack_token": 1
    },
    "files_scanned": 4,
    "findings_total": 5
  }
}