clemlesne commented 6 months ago

It would be useful to hide secret by testing case-insensitive regex rules than today.

A false positive is better than a pawn :)

Integration proposal

This new impleemntation could be achieved by using RegExp class:

let test = new RegExp(keyValue, 'i');  // Case insensitive match on purpose

if (test.test(secretKeys)) {
    // ...
}

Plus, the default configuration can be updated to:

"hide-my-secrets.secretKeys": [
    "(secret|password|token|key)"
],

Optionally, regex rules can be compiled and cached.

Issue example

Config extract:

"hide-my-secrets.secretKeys": [
    "password"
],

My secret config;

env:
    COSIGN_PASSWORD: xxx. # This is visible
    password: xxx  # This is hidden