Configuration

Four ways to tune what gets flagged, from narrowest to broadest.

Inline, single line

const demoKey = "AKIAABCDEFGHIJKLWXYZ"; // secretcheck-disable-line

Inline, next line

// secretcheck-disable-next-line
const demoKey = "AKIAABCDEFGHIJKLWXYZ";

By path — .secretcheckignore

Gitignore-style globs (**, *, ?) in the repo root, one per line:

fixtures/**
**/*.fixture.json
docs/examples/**

By config — .secretcheckrc.json

Repo-root JSON config for ignoring paths, disabling built-in rules, and adding your own:

{
  "ignorePaths": ["fixtures/**"],
  "disableRules": ["generic-api-key"],
  "customRules": [
    {
      "id": "internal-token",
      "description": "Internal service token",
      "pattern": "ITK-[A-Z0-9]{24}"
    }
  ]
}

pattern is a Go RE2 regular expression (no backreferences or lookaheads — RE2 is deliberately linear-time, so scanning can't be pathologically slow on adversarial input). Set "caseInsensitive": true on a custom rule instead of embedding inline flags like (?i) — RE2's inline-flag syntax is more limited than PCRE's.

Both files are optional and repo-local — nothing is read from outside the repo root.