secret-scan
| Field | Value |
|---|---|
| ID | secret-scan |
| Version | 1.0.0 |
| Mode | static |
| Layer | Stripe |
| Category | security |
| Severity | 🔴 blocking |
| SLA | 30,000 ms |
| Depends on | none |
| Source | packages/testing/src/gates/secret-scan.gate.ts |
What it asserts
Scans tracked files for committed secrets (Matter API keys, AWS, GitHub, Anthropic, OpenAI, private keys).
Run it locally
bun run gates --gate=secret-scanSee also
staticmode- Stripe layer
- Allowlists — how to bound a known finding with an expiration
- Contributing — how to evolve this gate or write a new one
Generated by apps/design/scripts/generate-gate-pages.ts from the gate's source-of-truth metadata. Edit this page by editing the gate file's description / version / etc.
route-manifest-property
Property: every path the route-manifest matcher returns for a known template matches that template's regex; literals beat params at the same depth.
spec-walker-mutation
Three hand-constructed mutations of the spec-walker are caught by the existing path-collection test. Proves walker coverage is real.