Rule samples
Each rule has mustMatch and mustIgnore samples. The engine runs them
at every load. If a sample fails, whac does not load the rules.
Whac-a-Leak
Whac-a-Leak (whac) is a secret scanner in pure Go. It finds API keys,
tokens, private keys and passwords in files, staged changes and git history.
Most scanners use a flat list of regexes. Whac-a-Leak writes its rules in CUE. CUE gives each rule a type, layers and its own samples. CUE runs once, when whac loads the rules. The scan itself is plain Go.
Layers
The binary contains the builtin rules. Your .whac/ config dir adds
layers: new rules, tighter rules, disabled or re-graded rules.
Two-tier engine
One Aho-Corasick keyword pass selects the candidate rules. Only those rules run their regex and charset-aware entropy checks.
Structured files
whac reads YAML, JSON, .env, properties and HCL-style files as key
paths. It finds a password at database.credentials.password.
Fingerprint allowlists
A whac1: fingerprint of the rule and the secret identifies each
finding. Allowlist entries do not depend on line numbers.
Offline
whac makes no network calls, sends no telemetry and does not test secrets against provider APIs. A secret stays on your machine.
Getting StartedBuild whac from source. See what works now.
Design DecisionsWhy CUE runs only at load time, how layers work, why entropy depends on the charset.