secrets
4 guardrails, all at version v1.
| Guardrail | Default severity | What it checks |
|---|---|---|
secrets/detector-ran | error | A secret detector ran, or left a report the build can be judged on, rather than nothing having looked for a credential at all. |
secrets/gitignore-present | warning | The repository carries a .gitignore, so build output and the local credential files beside it are not committed by the next person who runs git add .. |
secrets/no-credential-files-committed | error | None of the well known credential files is in the working tree: no .env, no private key, no keystore, no kubeconfig and no cloud credential file. |
secrets/no-hardcoded-credentials | error | Every secret the detector reported sits below the severity the team gates on, or is a rule the team has already accepted. |
Every guardrail in this category is configured the same way, in the guardrails.checks array of buildnote.json. See Configuring guardrails for every option, and Guardrails to search the whole library.