[Question] What does "hashed_secrets" stands for in the output?

[MVrachev]

There is no documentation about this and the name is not really self-explanatory.

[KevinHock]

I agree it is one of the more confusing things in the codebase,hashed_secret vs. secret_hash etc.

Succinctly it is the sha1 hash of

• the content of the secret (secret_hash)
• the plugin that found it (secret_type)
• and the name of the file the secret is in (filename).

It does not include line number of the secret, since that would cause the hash to change all the time.

The way hashed_secret gets set is:

detect-secrets/detect_secrets/core/potential_secret.py

Line 71 in 38b559c

'hashed_secret': self.secret_hash,

->

detect-secrets/detect_secrets/core/potential_secret.py

Line 47 in 38b559c

self.secret_hash = self.hash_secret(secret)

->

detect-secrets/detect_secrets/core/potential_secret.py

Lines 56 to 63 in 38b559c

	def hash_secret(secret):
	"""This offers a way to coherently test this class,
	without mocking self.secret_hash.
	:type secret: string
	:rtype: string
	"""
	return hashlib.sha1(secret.encode('utf-8')).hexdigest()

->

detect-secrets/detect_secrets/core/potential_secret.py

Lines 88 to 94 in 38b559c

	def __hash__(self):
	return hash(
	tuple(
	getattr(self, x)
	for x in self.fields_to_compare
	),
	)

->

detect-secrets/detect_secrets/core/potential_secret.py

Line 53 in 38b559c

self.fields_to_compare = ['filename', 'secret_hash', 'type']

This fields_to_compare part is especially important, e.g. one time we changed a secret type and it broke all the baselines 😁

[domanchi]

Something we definitely didn't want to happen is create a file with all secrets from a repository extracted. This way, you wouldn't be able to share these baselines around, because you'd be just contributing to the problem (secrets in source code).

The hashed_secret field is just the hash of the secret value, to accommodate for this use case.

[MVrachev]

Thank you for your answers!
I understand your motivation and idea now but maybe add more documentation about the hashed_secret attribute in the output.