Question
Should base64-encoded credentials be decoded and scanned, and at what false-positive cost?
Parent: #48
Blocked by: #49
siloscan matches plaintext only. A Kubernetes Secret manifest stores its values base64-encoded by specification, so every credential in every k8s Secret in a scanned working tree is currently invisible. That is not an exotic shape - it is the single most common way a credential sits in a repository that siloscan is otherwise well suited to scan. betterleaks decodes; gitleaks partially does via specific rules.
The design question is where decoding sits, and it is a real one because decoding multiplies the input every rule sees:
- Where: a pre-pass that emits decoded content as pseudo-content for the existing engines, or a rule-level
decode: option that only named rules opt into?
- How deep: single-pass, or nested (betterleaks handles double and triple encoding)? Each level costs scan time and false positives.
- Span reporting: a finding inside decoded content has no honest line/column in the source file. What does the report say, and what does the fingerprint cover? This is the hard part - fingerprints must stay stable, and the determinism contract must hold.
- Which encodings: base64 clearly. URL-encoding, hex, JWT payloads - each is a separate decision.
Blocked on #49 because "at what false-positive cost" is unanswerable without k8s manifests and base64-shaped noise (lockfile hashes, embedded certificates, minified assets) in the corpus. Entropy rules on decoded binary content are a false-positive machine if unmeasured.
Deliverable: a decision recorded here with measurements, then implementation.
Question
Should base64-encoded credentials be decoded and scanned, and at what false-positive cost?
Parent: #48
Blocked by: #49
siloscan matches plaintext only. A Kubernetes
Secretmanifest stores its values base64-encoded by specification, so every credential in every k8s Secret in a scanned working tree is currently invisible. That is not an exotic shape - it is the single most common way a credential sits in a repository that siloscan is otherwise well suited to scan. betterleaks decodes; gitleaks partially does via specific rules.The design question is where decoding sits, and it is a real one because decoding multiplies the input every rule sees:
decode:option that only named rules opt into?Blocked on #49 because "at what false-positive cost" is unanswerable without k8s manifests and base64-shaped noise (lockfile hashes, embedded certificates, minified assets) in the corpus. Entropy rules on decoded binary content are a false-positive machine if unmeasured.
Deliverable: a decision recorded here with measurements, then implementation.