Part I · Day One · What the scanner sees · p. 14–15

Findings you can act on in ten seconds

Twelve built-in Rust scanners, all compiled into the binary, all sub-millisecond to low-millisecond per file.

The command surface

securegit scan .
securegit scan . --fail-on high
securegit scan . --include-git
securegit scan . --format sarif --report-output f.sarif
securegit scan . --format gitlab --report-output gl.json
securegit scan --staged
securegit scan . --write-baseline "<reason>"

--include-git deserves emphasis. Most scanners in the industry exclude .git by default, and the acquisition threat this magazine opens with lives precisely there.

Anatomy of a finding

Critical · secrets · src/config/settings.py:14

AWS Access Key AKIA*********

Rotate this credential, then remove from history.

Findings never print full secret values, including in JSON output. Scan output ends up in CI logs, which are frequently more readable than the repository was.

The ten-second triage

Is it in a test fixture or an example? Very common, usually benign — but check that the example key is actually fake.
Is it a real credential? If yes, stop reading this magazine. Rotate it. Removing it from the file is not sufficient.
Is it high entropy but not a secret? A hash, a test vector, a base64 asset. Suppress it by path, not by disabling the scanner.
Is it a pattern finding you disagree with? Read the line. “I know what I’m doing here” is sometimes correct and sometimes the exact sentence that precedes an incident.