Skip to content
Whac-a-Leak

Output Formats

Set the format with --format text (the default), --format json or --format sarif. whac redacts each secret. It keeps the first four and the last four characters of a single-line secret with 16 or more characters. It prints **** for other secrets. Add --no-redact to print each secret in full.

Text

Section titled “Text”
CRITICAL  GITHUB_TOKEN  app.env:4:10
          GitHub personal access, OAuth, app or refresh token
          secret: ghp_****oPqr
          fingerprint: whac1:ceaecd45ce7e62d41df233cda112cf1e4aed182b36f61607fec15d2826878fec


1 finding(s): 1 CRITICAL. Scanned 1 file(s), 187 B.

Line and column numbers start at 1. The column counts characters, not bytes. whac colors the severity when the output is a terminal and NO_COLOR is not set.

JSON

Section titled “JSON”
{
  "apiVersion": "whac.infrashift.io/v1alpha1",
  "kind": "ScanReport",
  "summary": {
    "findings": 1,
    "bySeverity": { "CRITICAL": 1 },
    "files": 1,
    "bytes": 187,
    "skippedBinary": 0,
    "skippedLarge": 0,
    "skippedExcluded": 0,
    "skippedUnreadable": 0,
    "suppressed": 0
  },
  "findings": [
    {
      "ruleId": "GITHUB_TOKEN",
      "description": "GitHub personal access, OAuth, app or refresh token",
      "severity": "CRITICAL",
      "path": "app.env",
      "line": 4,
      "column": 10,
      "endLine": 4,
      "fingerprint": "whac1:ceaecd45ce7e62d41df233cda112cf1e4aed182b36f61607fec15d2826878fec",
      "secret": "ghp_****oPqr",
      "redacted": true
    }
  ]
}

Each JSON finding has a category: secret for a matched secret, or exposure for reachable access to credentials, such as a socket. An exposure finding has no line and no secret. Agent-context findings print [masked] in place of every value.

A finding from --git also has commit, author and date. The text format prints them on a commit: line. The summary then counts commits and file changes.

An assignment finding also has keyPath, for example "database.credentials.password". The text format prints it as key:.

findings is an empty array when whac finds nothing. endLine differs from line for a secret that spans lines, such as a PEM key.

SARIF

Section titled “SARIF”

--format sarif writes SARIF 2.1.0 for code scanning services. SARIF output always redacts secrets. See CI & SARIF.

Write a report to a file

Section titled “Write a report to a file”

--format sets the report on stdout. --output FORMAT=PATH also writes a report to a file. One scan writes all reports. Repeat --output for more files.

Terminal window
whac scan . --output json=whac.json --output sarif=whac.sarif

whac prints the text report on the terminal. It writes whac.json and whac.sarif with the same findings.

  • FORMAT is text, json or sarif.
  • whac creates each file with mode 0600. A report file has no colors.
  • --no-redact applies to the files and to stdout. SARIF always redacts.
  • whac checks each --output value before the scan. A bad value, an unknown format or the same path two times gives exit code 2.
  • whac writes a temporary file and then renames it. If the write fails, the path keeps its old content, and whac exits with code 2.

One finding per line

Section titled “One finding per line”

The JSON report is one document. whac does not write JSON Lines. To get one finding per line, use jq:

Terminal window
jq -c '.findings[]' whac.json