feat: staged diff scanning, false-positive fixes, and a 4-9x faster scanner - #84

Draft

pixincreate wants to merge 20 commits into

masterfrom

feat/staged-scanning

Commits on Aug 25, 2026

chore: add self-scan config excluding test fixtures
pixincreate
committed
31a2b1f
fix(detectors): raise Base64Detector entropy threshold to 4.2
pixincreate
committed
60de57a
feat(scan): add --staged mode scanning only added lines of the staged diff
pixincreate
committed
ad8aca0
perf(scan): single-pass Aho-Corasick keyword prefilter
pixincreate
committed
4284ef2
fix(scan): never scan the --baseline file itself
pixincreate
committed
4a47aa1
feat(config): walk up ancestors for config discovery, bounded by trust
pixincreate
committed
57c6fff
feat(hooks): pre-commit hook delegates to scan --staged
pixincreate
committed
5b42995
refactor: prefer match over if/else chains in report output
pixincreate
committed
0d78694
fix(detectors): allowlist $PWD working-directory references in PasswordDetector
pixincreate
committed
9f01a70
docs: document staged scanning, config discovery, and hook behavior
pixincreate
committed
c1163fa
style: apply cargo fmt and allow 'caf' in typos config
pixincreate
committed
7692e0c
feat(baseline): auto-discover .keywatch-baseline.json and add update workflow
pixincreate
committed
326c433
fix(baseline): exclude the baseline file by canonical path
pixincreate
committed
3549d48
chore: dogfood a committed baseline instead of inline ignore comments
pixincreate
committed
7f4326e
refactor: address review feedback in scanner and hooks
pixincreate
committed
76b1bc7
fix: do not panic when stdout is closed
pixincreate
committed
e57d649
docs: condense the unreleased changelog to one line per change
pixincreate
committed
5cb7ccb
fix: match baseline and exclude paths regardless of separator
pixincreate
committed
66f745c
fix: close two detection bypasses found in review
pixincreate
committed
c391a60

Commits on Aug 26, 2026

fix(detectors): stop flagging code identifiers as credentials
pixincreate
committed
6508181

Navigation Menu

feat: staged diff scanning, false-positive fixes, and a 4-9x faster scanner - #84

feat: staged diff scanning, false-positive fixes, and a 4-9x faster scanner#84
pixincreate wants to merge 20 commits into
masterfrom
feat/staged-scanning

Commits on Aug 25, 2026

chore: add self-scan config excluding test fixtures

fix(detectors): raise Base64Detector entropy threshold to 4.2

feat(scan): add --staged mode scanning only added lines of the staged diff

perf(scan): single-pass Aho-Corasick keyword prefilter

fix(scan): never scan the --baseline file itself

feat(config): walk up ancestors for config discovery, bounded by trust

feat(hooks): pre-commit hook delegates to scan --staged

refactor: prefer match over if/else chains in report output

fix(detectors): allowlist $PWD working-directory references in PasswordDetector

docs: document staged scanning, config discovery, and hook behavior

style: apply cargo fmt and allow 'caf' in typos config

feat(baseline): auto-discover .keywatch-baseline.json and add update workflow

fix(baseline): exclude the baseline file by canonical path

chore: dogfood a committed baseline instead of inline ignore comments

refactor: address review feedback in scanner and hooks

fix: do not panic when stdout is closed

docs: condense the unreleased changelog to one line per change

fix: match baseline and exclude paths regardless of separator

fix: close two detection bypasses found in review

Commits on Aug 26, 2026

fix(detectors): stop flagging code identifiers as credentials