exported some methods and constructor since it will need to be be used by the enterprise pipeline as well

main.go

@@ -152,9 +152,6 @@ func init() {
 
 	cli.Version("trufflehog " + version.BuildVersion)
 
-	//Support -h for help
-	cli.HelpFlag.Short('h')
-
 	if len(os.Args) <= 1 && isatty.IsTerminal(os.Stdout.Fd()) {
 		args := tui.Run()
 		if len(args) == 0 {

pkg/decoders/base64.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"encoding/base64"
 
+	"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/sources"
 )
 
@@ -25,7 +26,8 @@ func init() {
 	}
 }
 
-func (d *Base64) FromChunk(chunk *sources.Chunk) *sources.Chunk {
+func (d *Base64) FromChunk(chunk *sources.Chunk) *DecodableChunk {
+	decodableChunk := &DecodableChunk{Chunk: chunk, DecoderType: detectorspb.DecoderType_BASE64}
 	encodedSubstrings := getSubstringsOfCharacterSet(chunk.Data, 20, b64CharsetMapping, b64EndChars)
 	decodedSubstrings := make(map[string][]byte)
 
@@ -61,7 +63,7 @@ func (d *Base64) FromChunk(chunk *sources.Chunk) *sources.Chunk {
 		}
 		result.Write(chunk.Data[start:])
 		chunk.Data = result.Bytes()
-		return chunk
+		return decodableChunk
 	}
 
 	return nil

pkg/decoders/decoders.go

@@ -1,6 +1,7 @@
 package decoders
 
 import (
+	"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/sources"
 )
 
@@ -13,8 +14,15 @@ func DefaultDecoders() []Decoder {
 	}
 }
 
+// DecodableChunk is a chunk that includes the type of decoder used.
+// This allows us to avoid a type assertion on each decoder.
+type DecodableChunk struct {
+	*sources.Chunk
+	DecoderType detectorspb.DecoderType
+}
+
 type Decoder interface {
-	FromChunk(chunk *sources.Chunk) *sources.Chunk
+	FromChunk(chunk *sources.Chunk) *DecodableChunk
 }
 
 // Fuzz is an entrypoint for go-fuzz, which is an AFL-style fuzzing tool.

pkg/decoders/utf16.go

@@ -5,22 +5,24 @@ import (
 	"encoding/binary"
 	"unicode/utf8"
 
+	"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/sources"
 )
 
 type UTF16 struct{}
 
-func (d *UTF16) FromChunk(chunk *sources.Chunk) *sources.Chunk {
+func (d *UTF16) FromChunk(chunk *sources.Chunk) *DecodableChunk {
 	if chunk == nil || len(chunk.Data) == 0 {
 		return nil
 	}
 
+	decodableChunk := &DecodableChunk{Chunk: chunk, DecoderType: detectorspb.DecoderType_UTF16}
 	if utf16Data, err := utf16ToUTF8(chunk.Data); err == nil {
 		if len(utf16Data) == 0 {
 			return nil
 		}
 		chunk.Data = utf16Data
-		return chunk
+		return decodableChunk
 	}
 
 	return nil

pkg/decoders/utf8.go

@@ -4,22 +4,25 @@ import (
 	"bytes"
 	"unicode/utf8"
 
+	"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/sources"
 )
 
 type UTF8 struct{}
 
-func (d *UTF8) FromChunk(chunk *sources.Chunk) *sources.Chunk {
+func (d *UTF8) FromChunk(chunk *sources.Chunk) *DecodableChunk {
 	if chunk == nil || len(chunk.Data) == 0 {
 		return nil
 	}
 
+	decodableChunk := &DecodableChunk{Chunk: chunk, DecoderType: detectorspb.DecoderType_PLAIN}
+
 	if !utf8.Valid(chunk.Data) {
 		chunk.Data = extractSubstrings(chunk.Data)
-		return chunk
+		return decodableChunk
 	}
 
-	return chunk
+	return decodableChunk
 }
 
 // extractSubstrings performs similarly to the strings binutil,

pkg/detectors/airtableapikey/airtableapikey.go

@@ -2,7 +2,6 @@ package airtableapikey
 
 import (
 	"context"
-	"encoding/json"
 	"fmt"
 	"net/http"
 	"regexp"
@@ -21,9 +20,8 @@ var _ detectors.Detector = (*Scanner)(nil)
 var (
 	client = common.SaneHttpClient()
 
-	appPat      = regexp.MustCompile(`(app[a-zA-Z0-9_-]{14})`) // could be part of url
-	keyPat      = regexp.MustCompile(`\b(key[a-zA-Z0-9_-]{14})\b`)
-	personalPat = regexp.MustCompile(`(\bpat[[:alnum:]]{14}\.[[:alnum:]]{64}\b)`)
+	appPat = regexp.MustCompile(`(app[a-zA-Z0-9_-]{14})`) // could be part of url
+	keyPat = regexp.MustCompile(`\b(key[a-zA-Z0-9_-]{14})\b`)
 )
 
 // Keywords are used for efficiently pre-filtering chunks.
@@ -32,31 +30,17 @@ func (s Scanner) Keywords() []string {
 	return []string{"airtable"}
 }
 
-type response struct {
-	Error struct {
-		Type    string `json:"type"`
-		Message string `json:"message"`
-	} `json:"error"`
-}
-
 // FromData will find and optionally verify AirtableApiKey secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
 	dataStr := string(data)
 
 	appMatches := appPat.FindAllStringSubmatch(dataStr, -1)
 	keyMatches := keyPat.FindAllStringSubmatch(dataStr, -1)
-	personalKeyMatches := personalPat.FindAllStringSubmatch(dataStr, -1)
-
-	if len(keyMatches) == 0 {
-		keyMatches = personalKeyMatches
-
-	}
 
 	for _, keyMatch := range keyMatches {
 		if len(keyMatch) != 2 {
 			continue
 		}
-
 		keyRes := strings.TrimSpace(keyMatch[1])
 
 		for _, appMatch := range appMatches {
@@ -83,15 +67,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 					defer res.Body.Close()
 					if res.StatusCode >= 200 && res.StatusCode < 300 {
 						s1.Verified = true
-					} else if res.StatusCode == 403 {
-						var resp response
-						if err = json.NewDecoder(res.Body).Decode(&resp); err == nil {
-							// check if the error is due to invalid permissions or model not found
-							if resp.Error.Type == "INVALID_PERMISSIONS_OR_MODEL_NOT_FOUND" {
-								// The key is verified as it works, but the user must enumerate the tables or permissions for the key.
-								s1.Verified = true
-							}
-						}
 					} else {
 						if detectors.IsKnownFalsePositive(keyRes, detectors.DefaultFalsePositives, true) {
 							continue

pkg/detectors/airtableapikey/airtableapikey_test.go

@@ -9,10 +9,9 @@ import (
 	"testing"
 	"time"
 
+	"github.com/kylelemons/godebug/pretty"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
 
-	"github.com/google/go-cmp/cmp"
-	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
 )
@@ -100,9 +99,8 @@ func TestAirtableApiKey_FromChunk(t *testing.T) {
 				}
 				got[i].Raw = nil
 			}
-			ignoreOpts := cmpopts.IgnoreFields(detectors.Result{}, "Raw", "RawV2", "VerificationError")
-			if diff := cmp.Diff(got, tt.want, ignoreOpts); diff != "" {
-				t.Errorf("Airtable.FromData() %s diff: (-got +want)\n%s", tt.name, diff)
+			if diff := pretty.Compare(got, tt.want); diff != "" {
+				t.Errorf("AirtableApiKey.FromData() %s diff: (-got +want)\n%s", tt.name, diff)
 			}
 		})
 	}

pkg/detectors/falsepositives_test.go

@@ -74,13 +74,6 @@ func TestStringShannonEntropy(t *testing.T) {
 			},
 			want: 0.22228483068568816,
 		},
-		{
-			name: "empty",
-			args: args{
-				input: "",
-			},
-			want: 0.0,
-		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {

pkg/detectors/github/github.go

@@ -97,7 +97,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 							s1.ExtraData["site_admin"] = fmt.Sprintf("%t", userResponse.SiteAdmin)
 							s1.ExtraData["name"] = userResponse.Name
 							s1.ExtraData["company"] = userResponse.Company
-							s1.ExtraData["scopes"] = res.Header.Get("X-OAuth-Scopes")
 						}
 					}
 				}

pkg/detectors/github/github_test.go

@@ -28,7 +28,6 @@ func TestGitHub_FromChunk(t *testing.T) {
 	unverifiedGhu := testSecrets.MustGetField("GITHUB_UNVERIFIED_GHU")
 	unverifiedGhs := testSecrets.MustGetField("GITHUB_UNVERIFIED_GHS")
 	unverifiedGhr := testSecrets.MustGetField("GITHUB_UNVERIFIED_GHR")
-	verifiedGhp := testSecrets.MustGetField("GITHUB_VERIFIED_GHP")
 
 	type args struct {
 		ctx    context.Context
@@ -42,32 +41,6 @@ func TestGitHub_FromChunk(t *testing.T) {
 		want    []detectors.Result
 		wantErr bool
 	}{
-		{
-			name: "found, verified ghp",
-			s:    Scanner{},
-			args: args{
-				ctx:    context.Background(),
-				data:   []byte(fmt.Sprintf("You can find a github secret %s within", verifiedGhp)),
-				verify: true,
-			},
-			want: []detectors.Result{
-				{
-					DetectorType: detectorspb.DetectorType_Github,
-					Verified:     true,
-					ExtraData: map[string]string{
-						"account_type":   "User",
-						"company":        "",
-						"name":           "",
-						"rotation_guide": "https://howtorotate.com/docs/tutorials/github/",
-						"scopes":         "notifications",
-						"site_admin":     "false",
-						"url":            "https://github.com/truffle-sandbox",
-						"username":       "truffle-sandbox",
-					},
-				},
-			},
-			wantErr: false,
-		},
 		{
 			name: "found, unverified ghp",
 			s:    Scanner{},
@@ -80,9 +53,6 @@ func TestGitHub_FromChunk(t *testing.T) {
 				{
 					DetectorType: detectorspb.DetectorType_Github,
 					Verified:     false,
-					ExtraData: map[string]string{
-						"rotation_guide": "https://howtorotate.com/docs/tutorials/github/",
-					},
 				},
 			},
 			wantErr: false,
@@ -99,9 +69,6 @@ func TestGitHub_FromChunk(t *testing.T) {
 				{
 					DetectorType: detectorspb.DetectorType_Github,
 					Verified:     false,
-					ExtraData: map[string]string{
-						"rotation_guide": "https://howtorotate.com/docs/tutorials/github/",
-					},
 				},
 			},
 			wantErr: false,
@@ -118,9 +85,6 @@ func TestGitHub_FromChunk(t *testing.T) {
 				{
 					DetectorType: detectorspb.DetectorType_Github,
 					Verified:     false,
-					ExtraData: map[string]string{
-						"rotation_guide": "https://howtorotate.com/docs/tutorials/github/",
-					},
 				},
 			},
 			wantErr: false,
@@ -137,9 +101,6 @@ func TestGitHub_FromChunk(t *testing.T) {
 				{
 					DetectorType: detectorspb.DetectorType_Github,
 					Verified:     false,
-					ExtraData: map[string]string{
-						"rotation_guide": "https://howtorotate.com/docs/tutorials/github/",
-					},
 				},
 			},
 			wantErr: false,
@@ -156,9 +117,6 @@ func TestGitHub_FromChunk(t *testing.T) {
 				{
 					DetectorType: detectorspb.DetectorType_Github,
 					Verified:     false,
-					ExtraData: map[string]string{
-						"rotation_guide": "https://howtorotate.com/docs/tutorials/github/",
-					},
 				},
 			},
 			wantErr: false,
@@ -175,9 +133,6 @@ func TestGitHub_FromChunk(t *testing.T) {
 				{
 					DetectorType: detectorspb.DetectorType_Github,
 					Verified:     false,
-					ExtraData: map[string]string{
-						"rotation_guide": "https://howtorotate.com/docs/tutorials/github/",
-					},
 				},
 			},
 			wantErr: false,

pkg/detectors/github_old/github_old.go

@@ -38,7 +38,6 @@ type userRes struct {
 	SiteAdmin bool   `json:"site_admin"`
 	Name      string `json:"name"`
 	Company   string `json:"company"`
-	UserURL   string `json:"html_url"`
 }
 
 // Keywords are used for efficiently pre-filtering chunks.
@@ -92,17 +91,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 						res.Body.Close()
 						if err == nil {
 							s1.Verified = true
-
-							if err == nil {
-								s1.Verified = true
-								s1.ExtraData["username"] = userResponse.Login
-								s1.ExtraData["url"] = userResponse.UserURL
-								s1.ExtraData["account_type"] = userResponse.Type
-								s1.ExtraData["site_admin"] = fmt.Sprintf("%t", userResponse.SiteAdmin)
-								s1.ExtraData["name"] = userResponse.Name
-								s1.ExtraData["company"] = userResponse.Company
-								s1.ExtraData["scopes"] = res.Header.Get("X-OAuth-Scopes")
-							}
 						}
 					}
 				}

pkg/detectors/sourcegraphcody/sourcegraphcody.go

@@ -1,91 +0,0 @@
-package sourcegraphcody
-
-import (
-	"context"
-	"fmt"
-	"net/http"
-	"regexp"
-	"strings"
-
-	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
-	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
-	"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
-)
-
-type Scanner struct {
-	client *http.Client
-}
-
-// Ensure the Scanner satisfies the interface at compile time.
-var _ detectors.Detector = (*Scanner)(nil)
-
-var (
-	defaultClient = common.SaneHttpClient()
-	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
-	keyPat = regexp.MustCompile(`\b(slk_[a-f0-9]{64})\b`)
-)
-
-// Keywords are used for efficiently pre-filtering chunks.
-// Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"slk_"}
-}
-
-// FromData will find and optionally verify Sourcegraphcody secrets in a given set of bytes.
-func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
-
-	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
-
-	for _, match := range matches {
-		if len(match) != 2 {
-			continue
-		}
-		resMatch := strings.TrimSpace(match[1])
-
-		s1 := detectors.Result{
-			DetectorType: detectorspb.DetectorType_SourcegraphCody,
-			Raw:          []byte(resMatch),
-		}
-
-		if verify {
-			client := s.client
-			if client == nil {
-				client = defaultClient
-			}
-			req, err := http.NewRequestWithContext(ctx, "GET", "https://cody-gateway.sourcegraph.com/v1/limits", nil)
-			req.Header.Add("Authorization", "Bearer "+resMatch)
-			if err != nil {
-				continue
-			}
-			res, err := client.Do(req)
-			if err == nil {
-				defer res.Body.Close()
-				if res.StatusCode >= 200 && res.StatusCode < 300 {
-					s1.Verified = true
-				} else if res.StatusCode == 403 || res.StatusCode == 401 {
-					// 403 when the gateway is not configured to accept the token,
-					// 401 when the token is invalid.
-					// The secret is determinately not verified (nothing to do)
-				} else {
-					s1.VerificationError = fmt.Errorf("unexpected HTTP response status %d", res.StatusCode)
-				}
-			} else {
-				s1.VerificationError = err
-			}
-		}
-
-		// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
-		if !s1.Verified && detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
-			continue
-		}
-
-		results = append(results, s1)
-	}
-
-	return results, nil
-}
-
-func (s Scanner) Type() detectorspb.DetectorType {
-	return detectorspb.DetectorType_SourcegraphCody
-}

pkg/detectors/sourcegraphcody/sourcegraphcody_test.go

@@ -1,162 +0,0 @@
-//go:build detectors
-// +build detectors
-
-package sourcegraphcody
-
-import (
-	"context"
-	"fmt"
-	"testing"
-	"time"
-
-	"github.com/google/go-cmp/cmp"
-	"github.com/google/go-cmp/cmp/cmpopts"
-
-	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
-
-	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
-	"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
-)
-
-func TestSourcegraphcody_FromChunk(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), time.Second*5)
-	defer cancel()
-	testSecrets, err := common.GetSecret(ctx, "trufflehog-testing", "detectors5")
-	if err != nil {
-		t.Fatalf("could not get test secrets from GCP: %s", err)
-	}
-	secret := testSecrets.MustGetField("SOURCEGRAPHCODY")
-	inactiveSecret := testSecrets.MustGetField("SOURCEGRAPHCODY_INACTIVE")
-
-	type args struct {
-		ctx    context.Context
-		data   []byte
-		verify bool
-	}
-	tests := []struct {
-		name                string
-		s                   Scanner
-		args                args
-		want                []detectors.Result
-		wantErr             bool
-		wantVerificationErr bool
-	}{
-		{
-			name: "found, verified",
-			s:    Scanner{},
-			args: args{
-				ctx:    context.Background(),
-				data:   []byte(fmt.Sprintf("You can find a sourcegraphcody secret %s within", secret)),
-				verify: true,
-			},
-			want: []detectors.Result{
-				{
-					DetectorType: detectorspb.DetectorType_SourcegraphCody,
-					Verified:     true,
-				},
-			},
-			wantErr:             false,
-			wantVerificationErr: false,
-		},
-		{
-			name: "found, unverified",
-			s:    Scanner{},
-			args: args{
-				ctx:    context.Background(),
-				data:   []byte(fmt.Sprintf("You can find a sourcegraphcody secret %s within but not valid", inactiveSecret)), // the secret would satisfy the regex but not pass validation
-				verify: true,
-			},
-			want: []detectors.Result{
-				{
-					DetectorType: detectorspb.DetectorType_SourcegraphCody,
-					Verified:     false,
-				},
-			},
-			wantErr:             false,
-			wantVerificationErr: false,
-		},
-		{
-			name: "not found",
-			s:    Scanner{},
-			args: args{
-				ctx:    context.Background(),
-				data:   []byte("You cannot find the secret within"),
-				verify: true,
-			},
-			want:                nil,
-			wantErr:             false,
-			wantVerificationErr: false,
-		},
-		{
-			name: "found, would be verified if not for timeout",
-			s:    Scanner{client: common.SaneHttpClientTimeOut(1 * time.Microsecond)},
-			args: args{
-				ctx:    context.Background(),
-				data:   []byte(fmt.Sprintf("You can find a sourcegraphcody secret %s within", secret)),
-				verify: true,
-			},
-			want: []detectors.Result{
-				{
-					DetectorType: detectorspb.DetectorType_SourcegraphCody,
-					Verified:     false,
-				},
-			},
-			wantErr:             false,
-			wantVerificationErr: true,
-		},
-		{
-			name: "found, verified but unexpected api surface",
-			s:    Scanner{client: common.ConstantResponseHttpClient(404, "")},
-			args: args{
-				ctx:    context.Background(),
-				data:   []byte(fmt.Sprintf("You can find a sourcegraphcody secret %s within", secret)),
-				verify: true,
-			},
-			want: []detectors.Result{
-				{
-					DetectorType: detectorspb.DetectorType_SourcegraphCody,
-					Verified:     false,
-				},
-			},
-			wantErr:             false,
-			wantVerificationErr: true,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, err := tt.s.FromData(tt.args.ctx, tt.args.verify, tt.args.data)
-			if (err != nil) != tt.wantErr {
-				t.Errorf("Sourcegraphcody.FromData() error = %v, wantErr %v", err, tt.wantErr)
-				return
-			}
-			for i := range got {
-				if len(got[i].Raw) == 0 {
-					t.Fatalf("no raw secret present: \n %+v", got[i])
-				}
-				if (got[i].VerificationError != nil) != tt.wantVerificationErr {
-					t.Fatalf("wantVerificationError = %v, verification error = %v", tt.wantVerificationErr, got[i].VerificationError)
-				}
-			}
-			ignoreOpts := cmpopts.IgnoreFields(detectors.Result{}, "Raw", "VerificationError")
-			if diff := cmp.Diff(got, tt.want, ignoreOpts); diff != "" {
-				t.Errorf("Sourcegraphcody.FromData() %s diff: (-got +want)\n%s", tt.name, diff)
-			}
-		})
-	}
-}
-
-func BenchmarkFromData(benchmark *testing.B) {
-	ctx := context.Background()
-	s := Scanner{}
-	for name, data := range detectors.MustGetBenchmarkData() {
-		benchmark.Run(name, func(b *testing.B) {
-			b.ResetTimer()
-			for n := 0; n < b.N; n++ {
-				_, err := s.FromData(ctx, false, data)
-				if err != nil {
-					b.Fatal(err)
-				}
-			}
-		})
-	}
-}

pkg/detectors/twilio/twilio.go

@@ -23,6 +23,7 @@ var (
 	identifierPat = regexp.MustCompile(`(?i)sid.{0,20}AC[0-9a-f]{32}`) // Should we have this? Seems restrictive.
 	sidPat        = regexp.MustCompile(`\bAC[0-9a-f]{32}\b`)
 	keyPat        = regexp.MustCompile(`\b[0-9a-f]{32}\b`)
+	client        = common.SaneHttpClient()
 )
 
 // Keywords are used for efficiently pre-filtering chunks.
@@ -58,7 +59,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			}
 
 			if verify {
-				client := s.client
+				client = s.client
 				if client == nil {
 					client = defaultClient
 				}

pkg/engine/ahocorasickcore.go

@@ -0,0 +1,112 @@
+package engine
+
+import (
+	"strings"
+
+	ahocorasick "github.com/BobuSumisu/aho-corasick"
+
+	"github.com/trufflesecurity/trufflehog/v3/pkg/context"
+	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
+	"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
+)
+
+// detectorKey is used to identify a detector in the keywordsToDetectors map.
+// Multiple detectors can have the same detector type but different versions.
+// This allows us to identify a detector by its type and version.
+type detectorKey struct {
+	detectorType detectorspb.DetectorType
+	version      int
+}
+
+// detectorInfo is used to store a detector and whether it should be verified.
+type detectorInfo struct {
+	detectors.Detector
+	shouldVerify bool
+}
+
+// AhoCorasickCore encapsulates the operations and data structures used for keyword matching via the
+// Aho-Corasick algorithm. It is responsible for constructing and managing the trie for efficient
+// substring searches, as well as mapping keywords to their associated detectors for rapid lookups.
+type AhoCorasickCore struct {
+	// prefilter is a ahocorasick struct used for doing efficient string
+	// matching given a set of words. (keywords from the rules in the config)
+	prefilter ahocorasick.Trie
+	// Maps for efficient lookups during detection.
+	detectorTypeToDetectorInfo map[detectorKey]detectorInfo
+	detectors                  map[bool][]detectors.Detector
+	keywordsToDetectors        map[string][]detectorKey
+}
+
+// NewAhoCorasickCore allocates and initializes a new instance of AhoCorasickCore.
+// It creates an empty keyword-to-detectors map for future string matching operations.
+// The map detectorTypeToDetectorInfo is pre-allocated based on the size of detectors
+// provided, for efficient storage and lookup of detector information.
+func NewAhoCorasickCore(detectors map[bool][]detectors.Detector) *AhoCorasickCore {
+	return &AhoCorasickCore{
+		keywordsToDetectors:        make(map[string][]detectorKey),
+		detectors:                  detectors,
+		detectorTypeToDetectorInfo: make(map[detectorKey]detectorInfo, len(detectors[true])+len(detectors[false])),
+	}
+}
+
+// Setup initializes the internal state of AhoCorasickCore to prepare it for keyword matching.
+// This involves pre-filtering setup and lookup optimization, critical for the engine's performance.
+func (ac *AhoCorasickCore) Setup(ctx context.Context) {
+	// Prepare maps for fast detector lookups, instead of scanning through an array of detectors for every chunk.
+	var keywords []string
+	for verify, detectorsSet := range ac.detectors {
+		for _, d := range detectorsSet {
+			key := createDetectorKey(d)
+			ac.detectorTypeToDetectorInfo[key] = detectorInfo{Detector: d, shouldVerify: verify}
+			keywords = ac.extractAndMapKeywords(d, key, keywords)
+		}
+	}
+
+	// Use the Ahocorasick algorithm to create a trie structure for efficient keyword matching.
+	// This ensures that we can rapidly match against a vast set of keywords without individually comparing each one.
+	ac.prefilter = *ahocorasick.NewTrieBuilder().AddStrings(keywords).Build()
+	ctx.Logger().V(4).Info("AhoCorasickCore lookups built")
+	ctx.Logger().V(4).Info("AhoCorasickCore Setup complete")
+}
+
+// createDetectorKey creates a unique key for each detector. This key based on type and version,
+// it ensures faster lookups and reduces redundancy in our main detector store.
+func createDetectorKey(d detectors.Detector) detectorKey {
+	detectorType := d.Type()
+	var version int
+	if v, ok := d.(detectors.Versioner); ok {
+		version = v.Version()
+	}
+	return detectorKey{detectorType: detectorType, version: version}
+}
+
+// extractAndMapKeywords captures keywords associated with each detector and maps them.
+// This allows us to quickly determine which detectors are relevant based on the presence of certain keywords.
+func (ac *AhoCorasickCore) extractAndMapKeywords(d detectors.Detector, key detectorKey, keywords []string) []string {
+	for _, kw := range d.Keywords() {
+		kwLower := strings.ToLower(kw)
+		keywords = append(keywords, kwLower)
+		ac.keywordsToDetectors[kwLower] = append(ac.keywordsToDetectors[kwLower], key)
+	}
+	return keywords
+}
+
+// MatchString performs a string match using the Aho-Corasick algorithm, returning an array of matches.
+// Designed for internal use within the AhoCorasickCore component.
+func (ac *AhoCorasickCore) MatchString(input string) []*ahocorasick.Match {
+	return ac.prefilter.MatchString(strings.ToLower(input))
+}
+
+// PopulateDetectorsByMatch populates the given detectorMap based on the Aho-Corasick match results.
+// This method is designed to reuse the same map for performance optimization,
+// reducing the need for repeated allocations within each detector worker in the engine.
+func (ac *AhoCorasickCore) PopulateDetectorsByMatch(match *ahocorasick.Match, detectors map[detectorspb.DetectorType]detectorInfo) bool {
+	matchedKeys, ok := ac.keywordsToDetectors[match.MatchString()]
+	if !ok {
+		return false
+	}
+	for _, key := range matchedKeys {
+		detectors[key.detectorType] = ac.detectorTypeToDetectorInfo[key]
+	}
+	return true
+}

pkg/engine/defaults.go

@@ -8,7 +8,6 @@ import (
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/salesforce"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/snowflake"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/sourcegraph"
-	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/sourcegraphcody"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/tailscale"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/trufflehogenterprise"
 
@@ -1553,7 +1552,6 @@ func DefaultDetectors() []detectors.Detector {
 		web3storage.Scanner{},
 		&ramp.Scanner{},
 		&anthropic.Scanner{},
-		&sourcegraphcody.Scanner{},
 	}
 
 }

pkg/engine/engine.go

@@ -3,14 +3,11 @@ package engine
 import (
 	"bytes"
 	"fmt"
-	"reflect"
 	"runtime"
-	"strings"
 	"sync"
 	"sync/atomic"
 	"time"
 
-	ahocorasick "github.com/BobuSumisu/aho-corasick"
 	lru "github.com/hashicorp/golang-lru"
 	"google.golang.org/protobuf/proto"
 
@@ -66,9 +63,8 @@ type Engine struct {
 	onlyVerified         bool
 	printAvgDetectorTime bool
 
-	// prefilter is a ahocorasick struct used for doing efficient string
-	// matching given a set of words (keywords from the rules in the config)
-	prefilter ahocorasick.Trie
+	// ahoCorasickHandler manages the Aho-Corasick trie and related keyword lookups.
+	ahoCorasickCore *AhoCorasickCore
 
 	// Engine synchronization primitives.
 	sourceManager        *sources.SourceManager
@@ -93,9 +89,10 @@ type Engine struct {
 	dedupeCache *lru.Cache
 }
 
-type EngineOption func(*Engine)
+// Option is used to configure the engine during initialization using functional options.
+type Option func(*Engine)
 
-func WithConcurrency(concurrency uint8) EngineOption {
+func WithConcurrency(concurrency uint8) Option {
 	return func(e *Engine) {
 		e.concurrency = concurrency
 	}
@@ -103,7 +100,7 @@ func WithConcurrency(concurrency uint8) EngineOption {
 
 const ignoreTag = "trufflehog:ignore"
 
-func WithDetectors(verify bool, d ...detectors.Detector) EngineOption {
+func WithDetectors(verify bool, d ...detectors.Detector) Option {
 	return func(e *Engine) {
 		if e.detectors == nil {
 			e.detectors = make(map[bool][]detectors.Detector)
@@ -116,7 +113,7 @@ func WithDetectors(verify bool, d ...detectors.Detector) EngineOption {
 	}
 }
 
-func WithDecoders(decoders ...decoders.Decoder) EngineOption {
+func WithDecoders(decoders ...decoders.Decoder) Option {
 	return func(e *Engine) {
 		e.decoders = decoders
 	}
@@ -124,14 +121,14 @@ func WithDecoders(decoders ...decoders.Decoder) EngineOption {
 
 // WithFilterUnverified sets the filterUnverified flag on the engine. If set to
 // true, the engine will only return the first unverified result for a chunk for a detector.
-func WithFilterUnverified(filter bool) EngineOption {
+func WithFilterUnverified(filter bool) Option {
 	return func(e *Engine) {
 		e.filterUnverified = filter
 	}
 }
 
 // WithFilterEntropy filters out unverified results using Shannon entropy.
-func WithFilterEntropy(entropy float64) EngineOption {
+func WithFilterEntropy(entropy float64) Option {
 	return func(e *Engine) {
 		if entropy > 0 {
 			e.filterEntropy = &entropy
@@ -141,7 +138,7 @@ func WithFilterEntropy(entropy float64) EngineOption {
 
 // WithOnlyVerified sets the onlyVerified flag on the engine. If set to true,
 // the engine will only print verified results.
-func WithOnlyVerified(onlyVerified bool) EngineOption {
+func WithOnlyVerified(onlyVerified bool) Option {
 	return func(e *Engine) {
 		e.onlyVerified = onlyVerified
 	}
@@ -153,7 +150,7 @@ func WithOnlyVerified(onlyVerified bool) EngineOption {
 // the engine is configured to print the results.
 // Calculating the average time taken by each detector is an expensive operation
 // and should be avoided unless specified by the user.
-func WithPrintAvgDetectorTime(printAvgDetectorTime bool) EngineOption {
+func WithPrintAvgDetectorTime(printAvgDetectorTime bool) Option {
 	return func(e *Engine) {
 		e.printAvgDetectorTime = printAvgDetectorTime
 	}
@@ -163,7 +160,7 @@ func WithPrintAvgDetectorTime(printAvgDetectorTime bool) EngineOption {
 // the filterFunc returns true, the detector will be included for scanning.
 // This option applies to the existing list of detectors configured, so the
 // order this option appears matters. All filtering happens before scanning.
-func WithFilterDetectors(filterFunc func(detectors.Detector) bool) EngineOption {
+func WithFilterDetectors(filterFunc func(detectors.Detector) bool) Option {
 	return func(e *Engine) {
 		// If no detectors are configured, do nothing.
 		if e.detectors == nil {
@@ -175,7 +172,7 @@ func WithFilterDetectors(filterFunc func(detectors.Detector) bool) EngineOption
 }
 
 // WithPrinter sets the Printer on the engine.
-func WithPrinter(printer Printer) EngineOption {
+func WithPrinter(printer Printer) Option {
 	return func(e *Engine) {
 		e.printer = printer
 	}
@@ -269,32 +266,60 @@ func (e *Engine) DetectorAvgTime() map[string][]time.Duration {
 	return avgTime
 }
 
-// Start the engine with options.
-func Start(ctx context.Context, options ...EngineOption) (*Engine, error) {
-	const (
-		defaultChannelBuffer = 1
-		// TODO (ahrav): Determine the optimal cache size.
-		cacheSize = 512 // number of entries in the LRU cache
-	)
+// Start initializes and activates the engine's processing pipeline.
+// It sets up various default configurations, prepares lookup structures for
+// detectors, conducts basic sanity checks, and kickstarts all necessary workers.
+// Once started, the engine begins processing input data to identify secrets.
+func Start(ctx context.Context, options ...Option) (*Engine, error) {
+	e := &Engine{}
+
+	if err := e.initialize(ctx, options...); err != nil {
+		return nil, err
+	}
+	e.setDefaults(ctx)
+	ctx.Logger().V(4).Info("setting up aho-corasick core")
+	e.ahoCorasickCore.Setup(ctx)
+	e.sanityChecks(ctx)
+	e.startWorkers(ctx)
+
+	return e, nil
+}
+
+const defaultChannelBuffer = 1
+
+// initialize prepares the engine's internal structures. The LRU cache optimizes
+// deduplication efforts, allowing the engine to quickly check if a chunk has
+// been processed before, thereby saving computational overhead.
+func (e *Engine) initialize(ctx context.Context, options ...Option) error {
+	// TODO (ahrav): Determine the optimal cache size.
+	const cacheSize = 512 // number of entries in the LRU cache
 
 	cache, err := lru.New(cacheSize)
 	if err != nil {
-		return nil, fmt.Errorf("failed to initialize LRU cache: %w", err)
+		return fmt.Errorf("failed to initialize LRU cache: %w", err)
 	}
 
-	e := &Engine{
-		detectableChunksChan: make(chan detectableChunk, defaultChannelBuffer),
-		results:              make(chan detectors.ResultWithMetadata, defaultChannelBuffer),
-		dedupeCache:          cache,
-		printer:              new(output.PlainPrinter), // default printer
-		metrics:              runtimeMetrics{Metrics: Metrics{scanStartTime: time.Now()}},
-	}
+	// Channels are used for communication between different parts of the engine,
+	// ensuring that data flows smoothly without race conditions.
+	e.detectableChunksChan = make(chan detectableChunk, defaultChannelBuffer)
+	e.results = make(chan detectors.ResultWithMetadata, defaultChannelBuffer)
+	e.dedupeCache = cache
+	e.printer = new(output.PlainPrinter)
+	e.metrics = runtimeMetrics{Metrics: Metrics{scanStartTime: time.Now()}}
 
 	for _, option := range options {
 		option(e)
 	}
+	ctx.Logger().V(4).Info("engine initialized")
+	e.ahoCorasickCore = NewAhoCorasickCore(e.detectors)
 
-	// Set defaults.
+	return nil
+}
+
+// setDefaults ensures that if specific engine properties aren't provided,
+// they're set to reasonable default values. It makes the engine robust to
+// incomplete configuration.
+func (e *Engine) setDefaults(ctx context.Context) {
 	if e.concurrency == 0 {
 		numCPU := runtime.NumCPU()
 		ctx.Logger().Info("No concurrency specified, defaulting to max", "cpu", numCPU)
@@ -302,12 +327,13 @@ func Start(ctx context.Context, options ...EngineOption) (*Engine, error) {
 	}
 	ctx.Logger().V(3).Info("engine started", "workers", e.concurrency)
 
-	// Create SourceManager.
 	e.sourceManager = sources.NewManager(
 		sources.WithConcurrentSources(int(e.concurrency)),
 		sources.WithConcurrentUnits(int(e.concurrency)),
+		sources.WithBufferedOutput(defaultChannelBuffer),
 	)
 
+	// Default decoders handle common encoding formats.
 	if len(e.decoders) == 0 {
 		e.decoders = decoders.DefaultDecoders()
 	}
@@ -317,46 +343,30 @@ func Start(ctx context.Context, options ...EngineOption) (*Engine, error) {
 		e.detectors[true] = DefaultDetectors()
 		e.detectors[false] = []detectors.Detector{}
 	}
+	ctx.Logger().V(4).Info("default engine options set")
+}
 
-	// build ahocorasick prefilter for efficient string matching
-	// on keywords
-	keywords := []string{}
-	for _, d := range e.detectors[false] {
-		for _, kw := range d.Keywords() {
-			keywords = append(keywords, strings.ToLower(kw))
-		}
-	}
-	for _, d := range e.detectors[true] {
-		for _, kw := range d.Keywords() {
-			keywords = append(keywords, strings.ToLower(kw))
-		}
-	}
-	e.prefilter = *ahocorasick.NewTrieBuilder().AddStrings(keywords).Build()
-
-	ctx.Logger().V(3).Info("loaded decoders", "count", len(e.decoders))
-	ctx.Logger().V(3).Info("loaded detectors",
-		"total", len(e.detectors[true])+len(e.detectors[false]),
-		"verification_enabled", len(e.detectors[true]),
-		"verification_disabled", len(e.detectors[false]),
-	)
-
-	// Sanity check detectors for duplicate configuration. Only log in case
-	// a detector has been configured in a way that isn't represented by
-	// the DetectorID (type and version).
-	{
-		dets := append(e.detectors[true], e.detectors[false]...)
-		seenDetectors := make(map[config.DetectorID]struct{}, len(dets))
-		for _, det := range dets {
-			id := config.GetDetectorID(det)
-			if _, ok := seenDetectors[id]; ok && id.ID != detectorspb.DetectorType_CustomRegex {
-				ctx.Logger().Info("possible duplicate detector configured", "detector", id)
-			}
-			seenDetectors[id] = struct{}{}
+// Sanity check detectors for duplicate configuration. Only log in case
+// a detector has been configured in a way that isn't represented by
+// the DetectorID (type and version).
+func (e *Engine) sanityChecks(ctx context.Context) {
+	dets := append(e.detectors[true], e.detectors[false]...)
+	seenDetectors := make(map[config.DetectorID]struct{}, len(dets))
+	for _, det := range dets {
+		id := config.GetDetectorID(det)
+		if _, ok := seenDetectors[id]; ok && id.ID != detectorspb.DetectorType_CustomRegex {
+			ctx.Logger().Info("possible duplicate detector configured", "detector", id)
 		}
+		seenDetectors[id] = struct{}{}
 	}
+}
 
+// startWorkers initiates all necessary workers. Workers handle processing of
+// chunks concurrently. Separating the initialization of different types of
+// workers helps in scalability and makes it easier to diagnose issues.
+func (e *Engine) startWorkers(ctx context.Context) {
+	// Scanner workers process input data and extract chunks for detectors.
 	ctx.Logger().V(2).Info("starting scanner workers", "count", e.concurrency)
-	// Run the Secret scanner workers and Notifier pipelines.
 	for worker := uint64(0); worker < uint64(e.concurrency); worker++ {
 		e.workersWg.Add(1)
 		go func() {
@@ -367,6 +377,7 @@ func Start(ctx context.Context, options ...EngineOption) (*Engine, error) {
 		}()
 	}
 
+	// Detector workers apply keyword matching, regexes and API calls to detect secrets in chunks.
 	const detectorWorkerMultiplier = 50
 	ctx.Logger().V(2).Info("starting detector workers", "count", e.concurrency*detectorWorkerMultiplier)
 	for worker := uint64(0); worker < uint64(e.concurrency*detectorWorkerMultiplier); worker++ {
@@ -379,6 +390,7 @@ func Start(ctx context.Context, options ...EngineOption) (*Engine, error) {
 		}()
 	}
 
+	// Notifier workers communicate detected issues to the user or any downstream systems.
 	// We want 1/4th of the notifier workers as the number of scanner workers.
 	const notifierWorkerRatio = 4
 	maxNotifierWorkers := 1
@@ -395,8 +407,6 @@ func Start(ctx context.Context, options ...EngineOption) (*Engine, error) {
 			e.notifyResults(ctx)
 		}()
 	}
-
-	return e, nil
 }
 
 // Finish waits for running sources to complete and workers to finish scanning
@@ -445,64 +455,42 @@ type detectableChunk struct {
 func (e *Engine) detectorWorker(ctx context.Context) {
 	var wgDetect sync.WaitGroup
 
+	// Reuse the same map to avoid allocations.
+	const avgDetectorsPerChunk = 2
+	chunkSpecificDetectors := make(map[detectorspb.DetectorType]detectorInfo, avgDetectorsPerChunk)
 	for originalChunk := range e.ChunksChan() {
 		for chunk := range sources.Chunker(originalChunk) {
-			matchedKeywords := make(map[string]struct{})
 			atomic.AddUint64(&e.metrics.BytesScanned, uint64(len(chunk.Data)))
 			for _, decoder := range e.decoders {
-				var decoderType detectorspb.DecoderType
-				switch decoder.(type) {
-				case *decoders.UTF8:
-					decoderType = detectorspb.DecoderType_PLAIN
-				case *decoders.Base64:
-					decoderType = detectorspb.DecoderType_BASE64
-				case *decoders.UTF16:
-					decoderType = detectorspb.DecoderType_UTF16
-				default:
-					ctx.Logger().Info("unknown decoder type", "type", reflect.TypeOf(decoder).String())
-					decoderType = detectorspb.DecoderType_UNKNOWN
-				}
-
 				decoded := decoder.FromChunk(chunk)
-
 				if decoded == nil {
+					ctx.Logger().V(4).Info("no decoder found for chunk", "chunk", chunk)
 					continue
 				}
 
-				// build a map of all keywords that were matched in the chunk
-				for _, m := range e.prefilter.MatchString(strings.ToLower(string(decoded.Data))) {
-					matchedKeywords[strings.ToLower(m.MatchString())] = struct{}{}
+				for _, match := range e.ahoCorasickCore.MatchString(string(decoded.Chunk.Data)) {
+					if !e.ahoCorasickCore.PopulateDetectorsByMatch(match, chunkSpecificDetectors) {
+						continue
+					}
 				}
 
-				for verify, detectorsSet := range e.detectors {
-					for _, detector := range detectorsSet {
-						chunkContainsKeyword := false
-						for _, kw := range detector.Keywords() {
-							if _, ok := matchedKeywords[strings.ToLower(kw)]; ok {
-								chunkContainsKeyword = true
-								break
-							}
-						}
-
-						if !chunkContainsKeyword {
-							continue
-						}
-
-						decoded.Verify = verify
-						wgDetect.Add(1)
-						e.detectableChunksChan <- detectableChunk{
-							chunk:    *decoded,
-							detector: detector,
-							decoder:  decoderType,
-							wgDoneFn: wgDetect.Done,
-						}
+				for k, detector := range chunkSpecificDetectors {
+					decoded.Chunk.Verify = detector.shouldVerify
+					wgDetect.Add(1)
+					e.detectableChunksChan <- detectableChunk{
+						chunk:    *decoded.Chunk,
+						detector: detector,
+						decoder:  decoded.DecoderType,
+						wgDoneFn: wgDetect.Done,
 					}
+					delete(chunkSpecificDetectors, k)
 				}
 			}
 		}
 		atomic.AddUint64(&e.metrics.ChunksScanned, 1)
 	}
 	wgDetect.Wait()
+	ctx.Logger().V(4).Info("finished scanning chunks")
 }
 
 func (e *Engine) detectChunks(ctx context.Context) {
@@ -635,7 +623,7 @@ func FragmentLineOffset(chunk *sources.Chunk, result *detectors.Result) (int64,
 	if !found {
 		return 0, false
 	}
-	lineNumber := int64(bytes.Count(before, []byte("\n")) + 1)
+	lineNumber := int64(bytes.Count(before, []byte("\n")))
 	// If the line contains the ignore tag, we should ignore the result.
 	endLine := bytes.Index(after, []byte("\n"))
 	if endLine == -1 {

pkg/engine/engine_test.go

@@ -32,7 +32,7 @@ func TestFragmentLineOffset(t *testing.T) {
 			result: &detectors.Result{
 				Raw: []byte("secret here"),
 			},
-			expectedLine: 3,
+			expectedLine: 2,
 			ignore:       true,
 		},
 		{
@@ -43,7 +43,7 @@ func TestFragmentLineOffset(t *testing.T) {
 			result: &detectors.Result{
 				Raw: []byte("secret here"),
 			},
-			expectedLine: 3,
+			expectedLine: 2,
 			ignore:       false,
 		},
 		{
@@ -54,7 +54,7 @@ func TestFragmentLineOffset(t *testing.T) {
 			result: &detectors.Result{
 				Raw: []byte("secret here"),
 			},
-			expectedLine: 5,
+			expectedLine: 4,
 			ignore:       false,
 		},
 		{
@@ -65,7 +65,7 @@ func TestFragmentLineOffset(t *testing.T) {
 			result: &detectors.Result{
 				Raw: []byte("secret\nhere"),
 			},
-			expectedLine: 5,
+			expectedLine: 4,
 			ignore:       false,
 		},
 		{
@@ -76,7 +76,7 @@ func TestFragmentLineOffset(t *testing.T) {
 			result: &detectors.Result{
 				Raw: []byte("secret\nhere"),
 			},
-			expectedLine: 4,
+			expectedLine: 3,
 			ignore:       true,
 		},
 		{
@@ -87,7 +87,7 @@ func TestFragmentLineOffset(t *testing.T) {
 			result: &detectors.Result{
 				Raw: []byte("secret here"),
 			},
-			expectedLine: 4,
+			expectedLine: 3,
 			ignore:       true,
 		},
 	}

pkg/engine/git_test.go

@@ -2,6 +2,7 @@ package engine
 
 import (
 	"os"
+	"runtime"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -120,9 +121,10 @@ func BenchmarkGitEngine(b *testing.B) {
 	defer cancel()
 
 	e, err := Start(ctx,
-		WithConcurrency(1),
+		WithConcurrency(uint8(runtime.NumCPU())),
 		WithDecoders(decoders.DefaultDecoders()...),
 		WithDetectors(false, DefaultDetectors()...),
+		WithPrinter(new(discardPrinter)),
 	)
 	assert.Nil(b, err)
 
@@ -133,6 +135,7 @@ func BenchmarkGitEngine(b *testing.B) {
 		}
 	}()
 
+	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		// TODO: this is measuring the time it takes to initialize the source
 		// and not to do the full scan

pkg/giturl/giturl.go

@@ -158,11 +158,6 @@ func UpdateLinkLineNumber(ctx context.Context, link string, newLine int64) strin
 		return link
 	}
 
-	if newLine <= 0 {
-		// Don't change the link if the line number is 0.
-		return link
-	}
-
 	switch determineProvider(link) {
 	case providerBitbucket:
 		// For Bitbucket, it doesn't support line links (based on the GenerateLink function).

pkg/giturl/giturl_test.go

@@ -251,14 +251,6 @@ func TestUpdateLinkLineNumber(t *testing.T) {
 			},
 			want: "https://onprem.customdomain.com/org/repo/commit/xyz123#L50",
 		},
-		{
-			name: "Don't include line when it's 0",
-			args: args{
-				link:    "https://github.com/coinbase/cbpay-js/issues/181",
-				newLine: int64(0),
-			},
-			want: "https://github.com/coinbase/cbpay-js/issues/181",
-		},
 		{
 			name: "Invalid link",
 			args: args{

pkg/pb/detectorspb/detectors.pb.go

@@ -1007,7 +1007,6 @@ const (
 	DetectorType_Anthropic                     DetectorType = 933
 	DetectorType_Ramp                          DetectorType = 934
 	DetectorType_Klaviyo                       DetectorType = 935
-	DetectorType_SourcegraphCody               DetectorType = 936
 )
 
 // Enum value maps for DetectorType.
@@ -1945,7 +1944,6 @@ var (
 		933: "Anthropic",
 		934: "Ramp",
 		935: "Klaviyo",
-		936: "SourcegraphCody",
 	}
 	DetectorType_value = map[string]int32{
 		"Alibaba":                       0,
@@ -2880,7 +2878,6 @@ var (
 		"Anthropic":                     933,
 		"Ramp":                          934,
 		"Klaviyo":                       935,
-		"SourcegraphCody":               936,
 	}
 )
 
@@ -3259,7 +3256,7 @@ var file_detectors_proto_rawDesc = []byte{
 	0x44, 0x65, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0b, 0x0a, 0x07, 0x55,
 	0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x09, 0x0a, 0x05, 0x50, 0x4c, 0x41, 0x49,
 	0x4e, 0x10, 0x01, 0x12, 0x0a, 0x0a, 0x06, 0x42, 0x41, 0x53, 0x45, 0x36, 0x34, 0x10, 0x02, 0x12,
-	0x09, 0x0a, 0x05, 0x55, 0x54, 0x46, 0x31, 0x36, 0x10, 0x03, 0x2a, 0xa6, 0x75, 0x0a, 0x0c, 0x44,
+	0x09, 0x0a, 0x05, 0x55, 0x54, 0x46, 0x31, 0x36, 0x10, 0x03, 0x2a, 0x90, 0x75, 0x0a, 0x0c, 0x44,
 	0x65, 0x74, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0b, 0x0a, 0x07, 0x41,
 	0x6c, 0x69, 0x62, 0x61, 0x62, 0x61, 0x10, 0x00, 0x12, 0x08, 0x0a, 0x04, 0x41, 0x4d, 0x51, 0x50,
 	0x10, 0x01, 0x12, 0x07, 0x0a, 0x03, 0x41, 0x57, 0x53, 0x10, 0x02, 0x12, 0x09, 0x0a, 0x05, 0x41,
@@ -4196,13 +4193,12 @@ var file_detectors_proto_rawDesc = []byte{
 	0x12, 0x12, 0x0a, 0x0d, 0x50, 0x6c, 0x61, 0x6e, 0x65, 0x74, 0x53, 0x63, 0x61, 0x6c, 0x65, 0x44,
 	0x62, 0x10, 0xa4, 0x07, 0x12, 0x0e, 0x0a, 0x09, 0x41, 0x6e, 0x74, 0x68, 0x72, 0x6f, 0x70, 0x69,
 	0x63, 0x10, 0xa5, 0x07, 0x12, 0x09, 0x0a, 0x04, 0x52, 0x61, 0x6d, 0x70, 0x10, 0xa6, 0x07, 0x12,
-	0x0c, 0x0a, 0x07, 0x4b, 0x6c, 0x61, 0x76, 0x69, 0x79, 0x6f, 0x10, 0xa7, 0x07, 0x12, 0x14, 0x0a,
-	0x0f, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x67, 0x72, 0x61, 0x70, 0x68, 0x43, 0x6f, 0x64, 0x79,
-	0x10, 0xa8, 0x07, 0x42, 0x3d, 0x5a, 0x3b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f,
-	0x6d, 0x2f, 0x74, 0x72, 0x75, 0x66, 0x66, 0x6c, 0x65, 0x73, 0x65, 0x63, 0x75, 0x72, 0x69, 0x74,
-	0x79, 0x2f, 0x74, 0x72, 0x75, 0x66, 0x66, 0x6c, 0x65, 0x68, 0x6f, 0x67, 0x2f, 0x76, 0x33, 0x2f,
-	0x70, 0x6b, 0x67, 0x2f, 0x70, 0x62, 0x2f, 0x64, 0x65, 0x74, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x73,
-	0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x0c, 0x0a, 0x07, 0x4b, 0x6c, 0x61, 0x76, 0x69, 0x79, 0x6f, 0x10, 0xa7, 0x07, 0x42, 0x3d, 0x5a,
+	0x3b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x74, 0x72, 0x75, 0x66,
+	0x66, 0x6c, 0x65, 0x73, 0x65, 0x63, 0x75, 0x72, 0x69, 0x74, 0x79, 0x2f, 0x74, 0x72, 0x75, 0x66,
+	0x66, 0x6c, 0x65, 0x68, 0x6f, 0x67, 0x2f, 0x76, 0x33, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x70, 0x62,
+	0x2f, 0x64, 0x65, 0x74, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x73, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (

pkg/sources/filesystem/filesystem.go

@@ -39,7 +39,8 @@ type Source struct {
 // Ensure the Source satisfies the interfaces at compile time
 var _ sources.Source = (*Source)(nil)
 var _ sources.SourceUnitUnmarshaller = (*Source)(nil)
-var _ sources.SourceUnitEnumChunker = (*Source)(nil)
+var _ sources.SourceUnitEnumerator = (*Source)(nil)
+var _ sources.SourceUnitChunker = (*Source)(nil)
 
 // Type returns the type of source.
 // It is used for matching source types in configuration and job input.

pkg/sources/filesystem/filesystem_test.go

@@ -15,7 +15,6 @@ import (
 	"github.com/trufflesecurity/trufflehog/v3/pkg/pb/source_metadatapb"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/pb/sourcespb"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/sources"
-	"github.com/trufflesecurity/trufflehog/v3/pkg/sourcestest"
 )
 
 func TestSource_Scan(t *testing.T) {
@@ -85,15 +84,23 @@ func TestSource_Scan(t *testing.T) {
 }
 
 func TestScanFile(t *testing.T) {
+	tmpfile, err := os.CreateTemp("", "example.txt")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.Remove(tmpfile.Name())
+
 	chunkSize := sources.ChunkSize
 	secretPart1 := "SECRET"
 	secretPart2 := "SPLIT"
 	// Split the secret into two parts and pad the rest of the chunk with A's.
 	data := strings.Repeat("A", chunkSize-len(secretPart1)) + secretPart1 + secretPart2 + strings.Repeat("A", chunkSize-len(secretPart2))
 
-	tmpfile, cleanup, err := createTempFile("", data)
+	_, err = tmpfile.Write([]byte(data))
+	assert.Nil(t, err)
+
+	err = tmpfile.Close()
 	assert.Nil(t, err)
-	defer cleanup()
 
 	source := &Source{}
 	chunksChan := make(chan *sources.Chunk, 2)
@@ -113,195 +120,3 @@ func TestScanFile(t *testing.T) {
 
 	assert.Contains(t, foundSecret, secretPart1+secretPart2)
 }
-
-func TestEnumerate(t *testing.T) {
-	t.Parallel()
-	ctx := context.Background()
-
-	// Setup the connection to test enumeration.
-	units := []string{
-		"/one", "/two", "/three",
-		"/path/to/dir/", "/path/to/another/dir/",
-	}
-	conn, err := anypb.New(&sourcespb.Filesystem{
-		Paths:       units[0:3],
-		Directories: units[3:],
-	})
-	assert.NoError(t, err)
-
-	// Initialize the source.
-	s := Source{}
-	err = s.Init(ctx, "test enumerate", 0, 0, true, conn, 1)
-	assert.NoError(t, err)
-
-	reporter := sourcestest.TestReporter{}
-	err = s.Enumerate(ctx, &reporter)
-	assert.NoError(t, err)
-
-	assert.Equal(t, len(units), len(reporter.Units))
-	assert.Equal(t, 0, len(reporter.UnitErrs))
-	for _, unit := range reporter.Units {
-		assert.Contains(t, units, unit.SourceUnitID())
-	}
-	for _, unit := range units {
-		assert.Contains(t, reporter.Units, sources.CommonSourceUnit{ID: unit})
-	}
-}
-
-func TestChunkUnit(t *testing.T) {
-	t.Parallel()
-	ctx := context.Background()
-
-	// Setup test file to chunk.
-	fileContents := "TestChunkUnit"
-	tmpfile, cleanup, err := createTempFile("", fileContents)
-	assert.NoError(t, err)
-	defer cleanup()
-
-	tmpdir, cleanup, err := createTempDir("", "foo", "bar", "baz")
-	assert.NoError(t, err)
-	defer cleanup()
-
-	conn, err := anypb.New(&sourcespb.Filesystem{})
-	assert.NoError(t, err)
-
-	// Initialize the source.
-	s := Source{}
-	err = s.Init(ctx, "test chunk unit", 0, 0, true, conn, 1)
-	assert.NoError(t, err)
-
-	// Happy path single file.
-	reporter := sourcestest.TestReporter{}
-	err = s.ChunkUnit(ctx, sources.CommonSourceUnit{
-		ID: tmpfile.Name(),
-	}, &reporter)
-	assert.NoError(t, err)
-
-	// Happy path directory.
-	err = s.ChunkUnit(ctx, sources.CommonSourceUnit{
-		ID: tmpdir,
-	}, &reporter)
-	assert.NoError(t, err)
-
-	// Error path.
-	err = s.ChunkUnit(ctx, sources.CommonSourceUnit{
-		ID: "/file/not/found",
-	}, &reporter)
-	assert.NoError(t, err)
-
-	assert.Equal(t, 4, len(reporter.Chunks))
-	assert.Equal(t, 1, len(reporter.ChunkErrs))
-	dataFound := make(map[string]struct{}, 4)
-	for _, chunk := range reporter.Chunks {
-		dataFound[string(chunk.Data)] = struct{}{}
-	}
-	assert.Contains(t, dataFound, fileContents)
-	assert.Contains(t, dataFound, "foo")
-	assert.Contains(t, dataFound, "bar")
-	assert.Contains(t, dataFound, "baz")
-}
-
-func TestEnumerateReporterErr(t *testing.T) {
-	t.Parallel()
-	ctx := context.Background()
-
-	// Setup the connection to test enumeration.
-	units := []string{
-		"/one", "/two", "/three",
-		"/path/to/dir/", "/path/to/another/dir/",
-	}
-	conn, err := anypb.New(&sourcespb.Filesystem{
-		Paths:       units[0:3],
-		Directories: units[3:],
-	})
-	assert.NoError(t, err)
-
-	// Initialize the source.
-	s := Source{}
-	err = s.Init(ctx, "test enumerate", 0, 0, true, conn, 1)
-	assert.NoError(t, err)
-
-	// Enumerate should always return an error if the reporter returns an
-	// error.
-	reporter := sourcestest.ErrReporter{}
-	err = s.Enumerate(ctx, &reporter)
-	assert.Error(t, err)
-}
-
-func TestChunkUnitReporterErr(t *testing.T) {
-	t.Parallel()
-	ctx := context.Background()
-
-	// Setup test file to chunk.
-	tmpfile, err := os.CreateTemp("", "example.txt")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer os.Remove(tmpfile.Name())
-
-	fileContents := []byte("TestChunkUnit")
-	_, err = tmpfile.Write(fileContents)
-	assert.NoError(t, err)
-	assert.NoError(t, tmpfile.Close())
-
-	conn, err := anypb.New(&sourcespb.Filesystem{})
-	assert.NoError(t, err)
-
-	// Initialize the source.
-	s := Source{}
-	err = s.Init(ctx, "test chunk unit", 0, 0, true, conn, 1)
-	assert.NoError(t, err)
-
-	// Happy path. ChunkUnit should always return an error if the reporter
-	// returns an error.
-	reporter := sourcestest.ErrReporter{}
-	err = s.ChunkUnit(ctx, sources.CommonSourceUnit{
-		ID: tmpfile.Name(),
-	}, &reporter)
-	assert.Error(t, err)
-
-	// Error path. ChunkUnit should always return an error if the reporter
-	// returns an error.
-	err = s.ChunkUnit(ctx, sources.CommonSourceUnit{
-		ID: "/file/not/found",
-	}, &reporter)
-	assert.Error(t, err)
-}
-
-// createTempFile is a helper function to create a temporary file in the given
-// directory with the provided contents. If dir is "", the operating system's
-// temp directory is used.
-func createTempFile(dir string, contents string) (*os.File, func(), error) {
-	tmpfile, err := os.CreateTemp(dir, "trufflehogtest")
-	if err != nil {
-		return nil, nil, err
-	}
-
-	if _, err := tmpfile.Write([]byte(contents)); err != nil {
-		_ = os.Remove(tmpfile.Name())
-		return nil, nil, err
-	}
-	if err := tmpfile.Close(); err != nil {
-		_ = os.Remove(tmpfile.Name())
-		return nil, nil, err
-	}
-	return tmpfile, func() { _ = os.Remove(tmpfile.Name()) }, nil
-}
-
-// createTempDir is a helper function to create a temporary directory in the
-// given directory with files containing the provided contents. If dir is "",
-// the operating system's temp directory is used.
-func createTempDir(dir string, contents ...string) (string, func(), error) {
-	tmpdir, err := os.MkdirTemp(dir, "trufflehogtest")
-	if err != nil {
-		return "", nil, err
-	}
-
-	for _, content := range contents {
-		if _, _, err := createTempFile(tmpdir, content); err != nil {
-			_ = os.RemoveAll(tmpdir)
-			return "", nil, err
-		}
-	}
-	return tmpdir, func() { _ = os.RemoveAll(tmpdir) }, nil
-}

pkg/sources/github/github.go

@@ -233,7 +233,7 @@ func (s *Source) Init(aCtx context.Context, name string, jobID sources.JobID, so
 			aCtx.Logger().Error(err, "invalid repository", "repo", repo)
 			continue
 		}
-		s.filteredRepoCache.Set(repo, r)
+		s.filteredRepoCache.Set(r, r)
 	}
 
 	s.includeIssueComments = s.conn.IncludeIssueComments

pkg/sourcestest/sourcestest.go

@@ -1,61 +0,0 @@
-package sourcestest
-
-import (
-	"fmt"
-
-	"github.com/trufflesecurity/trufflehog/v3/pkg/context"
-	"github.com/trufflesecurity/trufflehog/v3/pkg/sources"
-)
-
-type reporter interface {
-	sources.UnitReporter
-	sources.ChunkReporter
-}
-
-var (
-	_ reporter = (*TestReporter)(nil)
-	_ reporter = (*ErrReporter)(nil)
-)
-
-// TestReporter is a helper struct that implements both UnitReporter and
-// ChunkReporter by simply recording the values passed in the methods.
-type TestReporter struct {
-	Units     []sources.SourceUnit
-	UnitErrs  []error
-	Chunks    []sources.Chunk
-	ChunkErrs []error
-}
-
-func (t *TestReporter) UnitOk(_ context.Context, unit sources.SourceUnit) error {
-	t.Units = append(t.Units, unit)
-	return nil
-}
-func (t *TestReporter) UnitErr(_ context.Context, err error) error {
-	t.UnitErrs = append(t.UnitErrs, err)
-	return nil
-}
-func (t *TestReporter) ChunkOk(_ context.Context, chunk sources.Chunk) error {
-	t.Chunks = append(t.Chunks, chunk)
-	return nil
-}
-func (t *TestReporter) ChunkErr(_ context.Context, err error) error {
-	t.ChunkErrs = append(t.ChunkErrs, err)
-	return nil
-}
-
-// ErrReporter implements UnitReporter and ChunkReporter but always returns an
-// error.
-type ErrReporter struct{}
-
-func (ErrReporter) UnitOk(context.Context, sources.SourceUnit) error {
-	return fmt.Errorf("ErrReporter: UnitOk error")
-}
-func (ErrReporter) UnitErr(context.Context, error) error {
-	return fmt.Errorf("ErrReporter: UnitErr error")
-}
-func (ErrReporter) ChunkOk(context.Context, sources.Chunk) error {
-	return fmt.Errorf("ErrReporter: ChunkOk error")
-}
-func (ErrReporter) ChunkErr(context.Context, error) error {
-	return fmt.Errorf("ErrReporter: ChunkErr error")
-}

proto/detectors.proto

@@ -944,7 +944,6 @@ enum DetectorType {
   Anthropic = 933;
   Ramp = 934;
   Klaviyo = 935;
-  SourcegraphCody = 936;
 }
 
 message Result {