2 commits

Author	SHA1	Message	Date
Bryan Helmkamp	6c43c8b34b	Lazy-compile gitleaks regexes to eliminate startup cost ... Replace eager Regex compilation in GitleaksEngine::build() with OnceLock-based lazy compilation. Individual regexes (rule patterns, allowlist patterns, global allowlist patterns) are now compiled on first use rather than at startup. This drops dry-run time from ~1.4s to ~0.5s since the common no-match path never compiles any regexes. Also removes the warm_up() pre-loading function and its callers since lazy compilation makes it unnecessary. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-27 18:02:37 -05:00
Bryan Helmkamp	90e7bf229a	Add redact crate for secret detection and redaction in NDJSON logs ... Two-layer detection: Shannon entropy on high-entropy alphanumeric tokens (threshold 4.5) and gitleaks v8.22.1 pattern matching (202 rules) with Aho-Corasick keyword pre-filtering. JSONL-aware redaction skips exempt fields (IDs, paths) and image objects. 43 tests. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Entire-Checkpoint: 9e8476d16412	2026-02-25 15:25:52 -05:00