fix(secrets): scope the line pre-check veto to benign manifest lines (#812)

* fix(secrets): scope the line pre-check veto to benign manifest lines

containsSecretIndicators, the pre-check in front of the SECRETS keyword
pass, ran three whole-line substring checks before its provider-literal
admits: a version or boolean after the line's first colon, an
"integrity"/"checksum" key beside the bytes sha or md5, and a
"url"/"resolved"/"homepage" key beside a scheme and a registry or forge
host. A hit dropped the whole line, so one "url" member hid an AKIA key
ID, a ghp_/glpat-/xoxb- token, a JWT or a keyword-assigned password
anywhere else on it: no finding, no redacted copy, --pre-commit-mode
exit 0, and the --stdin redaction gateway passed the token through.

The provider-literal admits (JWT, every provider prefix, PEM markers) now
run first, and the three checks are replaced by one veto,
benignManifestLine, that rejects a line only when (a) it is exactly one
JSON member whose value is a version under 20 bytes, a boolean, an SRI
digest or a URL with no user info, query or '=', (b) no keyword stem
from the lists the keyword patterns are compiled from appears anywhere
on it, and (c) one of the old checks fires as well, so the veto is a
subset of what was skipped before. Checking only the key, as the issue's
prototype does, is unsound: in "https://api.session:8443/..." the
unquoted pattern reads `session:` as an assignment. findKeywordSecrets
is split into the gate and keywordCandidates so that the gate's contract
(a rejected line has no candidate) is tested.

Measured against v2.5.5 on identical inputs: the issue's nine triggers
report what their controls report (30 of 30 draws); matrix 1 goes from
99 to 0 of 143 trigger cells reporting nothing (controls 78/78 on both);
every matrix 2 cell, as low as 0/40 before, is 40/40; the redacted
copies, pre-commit exits and stdin gateway are fixed. No existing
finding changes type, text, line or confidence on the matrices, the
reproduction, 39 public npm lockfiles or 3,691 public files that hit an
old check, and main's suppression rules still suppress all of them. The
veto still skips 99.1% of the lockfile lines the old checks skipped;
SECRETS CPU on those lockfiles is 3-6% above v2.5.5 (with no veto at
all, 2.7x).

Closes #765

* test(goldencorpus): state the #765 trigger case's password length right

The fifth line of secrets_line_veto_triggers carries a 41-byte password,
not the 40-byte one its description named. The value stays 41 bytes: a
40-byte value beside an AKIA key ID is the shape secret scanners read
as an AWS key pair. Description only; no snapshot changes.

Refs #765

* docs(changelog): count all 31 seeded draws in the #765 entry

The reproduction ran on seeds 1-31; the entry quoted the 30 draws of
seeds 2-31. On all 31 every trigger reports what its control reports,
and main lost the 40-character password on 10 of them.

Refs #765

* chore(goldencorpus,changelog): rebase #765 onto main after #811

The rebase onto main (now carrying #811 and #799) auto-merged the #765
bullet into the Security section below the Go 1.27.3 entry; it is a bug
fix, so it moves under Bug Fixes, as its first entry: #813 appends its own
bullet after the #773 entry, and two PRs inserting at one seam would
conflict again at the second merge; distinct anchors merge in either order.

corpus.go: both #811 (overlap_groups_render_once) and #765 (the two
line-veto cases) appended to the case table; keep all three in that
order. The metadata key census is regenerated on top of main: the only
movement is +14 findings at 13 keys, which is the secrets_line_veto_triggers
case; no other bucket and no existing snapshot changed, and the two new
snapshots are byte-identical to the ones committed before the rebase.

---------

Co-authored-by: union <union@example.invalid>

Author: sectoramen

CHANGELOG.md

@@ -16,6 +16,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### 🐛 Bug Fixes
 
+- **secrets (line pre-check):** a `"url"`, `"checksum"` or version/boolean member anywhere on a line no
+  longer switches off token and keyword detection for that line
+  ([#765](https://github.com/awslabs/ferret-scan/issues/765)). `containsSecretIndicators`, the pre-check
+  in front of the keyword pass, ran three whole-line substring checks before its provider-literal
+  admits, and a hit dropped the line: one `"url": "https://github.com/…"` member, a
+  `"bucket": "shared-assets"` beside a `"checksum"` key (`shared` holds `sha`) or a trailing
+  `"verbose": true` hid an AKIA key ID, a `ghp_`/`glpat-`/`xoxb-` token, a JWT or a keyword-assigned
+  password anywhere else on it. Nothing reached the redactor, so no redacted copy was written,
+  `--pre-commit-mode` exited 0 and the `--stdin --enable-redaction` gateway passed the token through.
+  Measured on v2.5.5 with the issue's nine trigger files and their one-word controls: seven reported
+  nothing where the control reported every value, one (`"url"` beside a 40-character password) lost
+  its AKIA key ID on every draw and the password on 10 of 31, and one reported only the token that
+  #766's URI source finds outside the pre-check; 99 of 143 cells of 13 secret shapes × 11 trigger
+  contexts reported nothing; `glpat-`, `xoxb-`, AKIA, JWT and 12–20-character passwords were found 0
+  of 40 times after a `"url"` or `"integrity"` member and 40 of 40 after `"name"`. Now the
+  provider-literal admits (JWT, every provider prefix, PEM markers) run first, and the three checks
+  are replaced by one veto that skips a line only when it is wholly one benign manifest member — a
+  version under 20 bytes, a boolean, an SRI digest or a URL with no user info, query or `=` — with no
+  keyword stem anywhere on it, and was skipped before. Every trigger now reports what its control
+  reports (31 of 31 seeded draws), all 143 cells and every matrix cell (40 of 40) detect the value,
+  the lockfile decoy stays silent, both redacted copies hold no value, both pre-commit runs exit 1
+  and the gateway emits no token. **New findings only:** on the matrices,
+  the reproduction, 39 public npm lockfiles and 3,691 public files that hit one of the old checks, no
+  existing finding changes type, text, line or confidence, and main's suppression rules still suppress
+  every one of them; on a line whose token in URL user info is also a provider literal, the finding's
+  `detection_method` now reads `keyword_pattern` instead of `uri_userinfo`. One shape, absent from all
+  of those sets, does change an existing finding: a password in the user info of a `"url"`,
+  `"resolved"` or `"homepage"` URL on a registry or forge host whose user name ends in a keyword stem
+  (`https://deploy-token:<pw>@registry…`) is now reported, as on every other line, as the keyword
+  pass's wider `<pw>@host/path` span, so a rule written against the narrower finding must be
+  regenerated. The veto still skips 99.1% of the lockfile lines the old checks skipped; SECRETS CPU on
+  those lockfiles is 3–6% above v2.5.5 (deleting the checks outright measured 2.7x).
 - **redaction (overlapping findings):** two findings on one line whose values share bytes are now one
   write over their union, in every writer, so no part of either survives and which one is written no
   longer depends on input order ([#773](https://github.com/awslabs/ferret-scan/issues/773)). Each writer
@@ -39,6 +71,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   instead of writing part of it, and the audit log records one entry per group with every member's type
   in `member_types`. The `secrets_uri_userinfo_email_overlap` snapshot now masks the password's first
   character, which the email's mask used to keep.
+
 ### 🔒 Security
 
 - **build (go 1.27.3):** move every Go pin to **1.27.3**, which carries the fix for the one open Go

internal/goldencorpus/corpus.go

@@ -23,6 +23,8 @@ package goldencorpus
 import (
 	"archive/zip"
 	"bytes"
+	"crypto/sha512"
+	"encoding/base64"
 	"encoding/binary"
 	"encoding/json"
 	"encoding/xml"
@@ -57,6 +59,13 @@ func stripeKey(tag byte, bodyLen int) string {
 	return "pk_" + "live_" + body[:bodyLen-1] + "1"
 }
 
+// sriDigest is a real Subresource Integrity value, `sha512-` and the base64 SHA-512 of name, the
+// shape npm writes in every lockfile "integrity" member.
+func sriDigest(name string) string {
+	sum := sha512.Sum512([]byte(name))
+	return "sha512-" + base64.StdEncoding.EncodeToString(sum[:])
+}
+
 // Case is one corpus entry: a named input plus the validator set to run against
 // it. Keeping checks explicit per-case (rather than always "all") makes each
 // snapshot small, focused, and stable — adding a new validator does not churn
@@ -534,6 +543,110 @@ var Cases = []Case{
 			"call +1 449-87-4100\n" +
 			"call 212-555-0142 or card 4532-0151-1283-0366\n",
 	},
+	{
+		Name: "secrets_line_veto_triggers",
+		Description: "The #765 false negative: a benign manifest member anywhere on a line switched the " +
+			"keyword pass off for the WHOLE line. containsSecretIndicators ran three whole-line " +
+			"substring checks before its provider-literal admits -- a version or boolean after the " +
+			"line's first colon, an \"integrity\"/\"checksum\" key beside the bytes `sha` or `md5`, " +
+			"a \"url\"/\"resolved\"/\"homepage\" key beside a scheme and a registry or forge host -- " +
+			"and a hit dropped the line, so nothing on it reached a redacted copy, the pre-commit " +
+			"exit status or the stdin gateway.\n" +
+			"  These are the issue's nine triggers, one per line. Lines 1-5 are the URL check: a " +
+			"`\"url\"` member beside a password and an AWS key ID, a JSON-lines request log with a " +
+			"GitHub token in its Authorization header, a token in a `\"url\"`'s user info, a minified " +
+			"config whose `\"homepage\"` hid a Stripe key and a password, and the first line again " +
+			"with a 41-byte password. Line 6 is the checksum check fired by `shared-assets`. Lines 7-9 " +
+			"are the version/boolean check: a `\"verbose\": true` in a trailing shell comment, a " +
+			"provider literal as a key with a boolean value, and a password whose value looks like a " +
+			"version. Before the fix lines 1-4 and 6-9 reported nothing (line 3's token alone was " +
+			"found, by #766's URI source, which runs outside the gate) and line 5 only its 41-byte " +
+			"value. Each must now report what the line reports with the member's key, host or word " +
+			"changed, and the redaction snapshots must show no byte of any value. The values are " +
+			"synthetic: consonants and digits, the AWS key ID and GitHub token other cases already " +
+			"use. The issue's minified config carries a Slack bot token; a publishable Stripe key (see " +
+			"stripeKey) stands in for it, because push protection refuses a Slack-shaped value in a " +
+			"committed snapshot and any provider literal shows the same thing.",
+		Checks: []string{"SECRETS"},
+		Input: "{\"url\": \"https://github.com/orders/app\", \"password\": \"Vn3kQ8tZp6Wd2sHx\", \"key_id\": \"AKIA" + "QZ7MK2PL9VNB4RTX\"}\n" +
+			"{\"ts\":\"2026-01-01T00:00:00Z\",\"method\":\"GET\",\"url\":\"https://api.github.com/user\",\"headers\":{\"Authorization\":\"token ghp_" + "Q7mZ2vX9pL4kR8tB1nW6yC3hJ5dF0sG2aE7u\"}}\n" +
+			"    \"url\": \"git+https://x-access-token:ghp_" + "Q7mZ2vX9pL4kR8tB1nW6yC3hJ5dF0sG2aE7u@github.com/orders/app.git\"\n" +
+			"{\"name\":\"svc\",\"version\":\"0.0.1\",\"homepage\":\"https://github.com/orders/svc\",\"db\":{\"host\":\"db.invalid\",\"password\":\"Hc4Rw9Tq2Mz7Kb5N\"},\"stripe\":{\"publishable_key\":\"" + stripeKey('d', 30) + "\"}}\n" +
+			"{\"url\": \"https://github.com/orders/app\", \"password\": \"Rk7Pq2Wz9Mx4Lc8Vb3Nt6Hd5Gf2Js7Kw9Qp4Zr3Tn\", \"key_id\": \"AKIA" + "QZ7MK2PL9VNB4RTX\"}\n" +
+			"{\"bucket\":\"shared-assets\",\"checksum\":\"crc32:00000000\",\"password\":\"Jx8Bv3Nq6Wr2Kt9P\",\"key_id\":\"AKIA" + "QZ7MK2PL9VNB4RTX\"}\n" +
+			"export API_TOKEN=Mz5Hq8Tc3Vw7Rb2K # \"verbose\": true\n" +
+			"    \"AKIA" + "QZ7MK2PL9VNB4RTX\": true\n" +
+			"  \"password\": \"7.Kq4Zt9Wm2B\"\n",
+	},
+	{
+		Name: "secrets_line_veto_lockfile_decoys",
+		Description: "The lines the #765 veto exists for, which must stay EMPTY: an npm v3 lockfile and a " +
+			"package.json excerpt. Since #765 the keyword pass skips a line only when it is wholly one " +
+			"benign manifest member -- a version under 20 bytes, a boolean, an SRI digest, or a URL with " +
+			"no user info, query or `=` -- carries no keyword stem, and was skipped before. Every " +
+			"version, resolved, integrity, dev, homepage and repository line here is such a line. The " +
+			"ones that are not (the `||` range, the sponsor URL with its query, `js-tokens`, which " +
+			"spells the stem `token`) are scanned again, find nothing, and must stay empty too. The " +
+			"digests are real SHA-512 digests of the package names. `\"dev\": true` makes this file " +
+			"`development` for the file-wide environment verdict, as it does on main.",
+		Checks: []string{"SECRETS"},
+		Input: "{\n" +
+			"  \"name\": \"orders-app\",\n" +
+			"  \"version\": \"1.0.0\",\n" +
+			"  \"lockfileVersion\": 3,\n" +
+			"  \"requires\": true,\n" +
+			"  \"packages\": {\n" +
+			"    \"node_modules/left-pad\": {\n" +
+			"      \"version\": \"1.3.0\",\n" +
+			"      \"resolved\": \"https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz\",\n" +
+			"      \"integrity\": \"" + sriDigest("left-pad") + "\",\n" +
+			"      \"dev\": true,\n" +
+			"      \"license\": \"WTFPL\"\n" +
+			"    },\n" +
+			"    \"node_modules/@babel/core\": {\n" +
+			"      \"version\": \"7.22.5\",\n" +
+			"      \"resolved\": \"https://registry.npmjs.org/@babel/core/-/core-7.22.5.tgz\",\n" +
+			"      \"integrity\": \"" + sriDigest("@babel/core") + "\",\n" +
+			"      \"dependencies\": {\n" +
+			"        \"debug\": \"^4.1.0\",\n" +
+			"        \"semver\": \"^6.3.1\",\n" +
+			"        \"js-tokens\": \"^4.0.0\",\n" +
+			"        \"chalk\": \"^3.0.0 || ^4.0.0\"\n" +
+			"      },\n" +
+			"      \"engines\": {\n" +
+			"        \"node\": \">=6.9.0\"\n" +
+			"      },\n" +
+			"      \"funding\": {\n" +
+			"        \"type\": \"opencollective\",\n" +
+			"        \"url\": \"https://opencollective.com/babel\"\n" +
+			"      }\n" +
+			"    },\n" +
+			"    \"node_modules/js-tokens\": {\n" +
+			"      \"version\": \"4.0.0\",\n" +
+			"      \"resolved\": \"https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz\",\n" +
+			"      \"integrity\": \"" + sriDigest("js-tokens") + "\",\n" +
+			"      \"optional\": true\n" +
+			"    },\n" +
+			"    \"node_modules/ansi-styles\": {\n" +
+			"      \"version\": \"6.2.1\",\n" +
+			"      \"resolved\": \"https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.1.tgz\",\n" +
+			"      \"integrity\": \"" + sriDigest("ansi-styles") + "\",\n" +
+			"      \"funding\": {\n" +
+			"        \"url\": \"https://github.com/chalk/ansi-styles?sponsor=1\"\n" +
+			"      }\n" +
+			"    }\n" +
+			"  },\n" +
+			"  \"homepage\": \"https://github.com/orders/app#readme\",\n" +
+			"  \"repository\": {\n" +
+			"    \"type\": \"git\",\n" +
+			"    \"url\": \"git+https://github.com/orders/app.git\"\n" +
+			"  },\n" +
+			"  \"bugs\": {\n" +
+			"    \"url\": \"https://gitlab.com/orders/app/-/issues\"\n" +
+			"  },\n" +
+			"  \"checksum\": \"" + sriDigest("orders-app") + "\"\n" +
+			"}\n",
+	},
 	{
 		Name:        "ip_addresses",
 		Description: "Public vs private/loopback IPv4; locks IP_ADDRESS context handling.",

internal/goldencorpus/testdata/golden/metadata-key-census.txt

@@ -468,7 +468,7 @@ VISA	keys=13	band=1
 # 10 keys: 26 findings (band 1)
 # 11 keys: 22 findings (band 1)
 # 12 keys: 14 findings (band 1)
-# 13 keys: 88 findings (band 1)
+# 13 keys: 102 findings (band 1)
 # 14 keys: 18 findings (band 1)
 # 15 keys: 30 findings (band 2)
 # 17 keys: 1 findings (band 2)

internal/goldencorpus/testdata/golden/secrets_line_veto_lockfile_decoys.csv

@@ -0,0 +1 @@
+Filename,Type,Confidence Level,Confidence %,Line Number,Text

internal/goldencorpus/testdata/golden/secrets_line_veto_lockfile_decoys.gitlab-sast.json

@@ -0,0 +1,29 @@
+{
+  "remediations": [],
+  "scan": {
+    "analyzer": {
+      "id": "ferret-scan",
+      "name": "Ferret Scan",
+      "url": "https://github.com/awslabs/ferret-scan",
+      "vendor": {
+        "name": "Amazon Web Services"
+      },
+      "version": "0.0.0-development"
+    },
+    "end_time": "<TIMESTAMP>",
+    "scanner": {
+      "id": "ferret-scan",
+      "name": "Ferret Scan",
+      "url": "https://github.com/awslabs/ferret-scan",
+      "vendor": {
+        "name": "Amazon Web Services"
+      },
+      "version": "0.0.0-development"
+    },
+    "start_time": "<TIMESTAMP>",
+    "status": "success",
+    "type": "sast"
+  },
+  "version": "15.0.4",
+  "vulnerabilities": []
+}

internal/goldencorpus/testdata/golden/secrets_line_veto_lockfile_decoys.json.json

@@ -0,0 +1,3 @@
+{
+  "results": []
+}

internal/goldencorpus/testdata/golden/secrets_line_veto_lockfile_decoys.junit.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<testsuites name="ferret-scan" tests="0" failures="0" errors="0" time="0.000">
+  <testsuite name="security-scan" tests="0" failures="0" errors="0" time="0.000"></testsuite>
+</testsuites>

internal/goldencorpus/testdata/golden/secrets_line_veto_lockfile_decoys.redact_format_preserving.txt

@@ -0,0 +1,58 @@
+=== REDACTED ===
+{
+  "name": "orders-app",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "node_modules/left-pad": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
+      "integrity": "sha512-XRcglhh3p2lHAu4gFg75i5owZ3/uttIZh11iKj+W2fqc4Iu8OvwIHkDSftaw4gURo0WA2fT2oguwTa4HChLwJw==",
+      "dev": true,
+      "license": "WTFPL"
+    },
+    "node_modules/@babel/core": {
+      "version": "7.22.5",
+      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.22.5.tgz",
+      "integrity": "sha512-A/7v7t3swT1cyX5u/GhFT+yzhPPSdlJHh0dfFfuBJs/T6uhVVD4namjWQM5JVWUzdCVXmbe6CY1TKJv9RAOcsw==",
+      "dependencies": {
+        "debug": "^4.1.0",
+        "semver": "^6.3.1",
+        "js-tokens": "^4.0.0",
+        "chalk": "^3.0.0 || ^4.0.0"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/babel"
+      }
+    },
+    "node_modules/js-tokens": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
+      "integrity": "sha512-fIvNBV3y6EBRV/ibHHjLBDSpRbdhtKXf61DSzOV50xIpPgfbW/5lxDDVRmx4fZwRHf77QMVfworHea2SkYxOUA==",
+      "optional": true
+    },
+    "node_modules/ansi-styles": {
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.1.tgz",
+      "integrity": "sha512-EhXoniJkJjbZMaPS9yC77u2K93fKsYbaCeSyOCRST6uRDoAjzpTgKzF+7j3yt8UFq8cS9s+2q1DnnuYgNymgMQ==",
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    }
+  },
+  "homepage": "https://github.com/orders/app#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/orders/app.git"
+  },
+  "bugs": {
+    "url": "https://gitlab.com/orders/app/-/issues"
+  },
+  "checksum": "sha512-J+kyFiBsBm/fD8hhvHNNhwAwtxrtThSi5Bex9sbmegf4MdcWwPTn+Mv/OmIAJTWuSKOctlW0Iduj4/oo6+BT9w=="
+}
+=== FINDINGS (sorted) ===

internal/goldencorpus/testdata/golden/secrets_line_veto_lockfile_decoys.redact_simple.txt

@@ -0,0 +1,58 @@
+=== REDACTED ===
+{
+  "name": "orders-app",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "node_modules/left-pad": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
+      "integrity": "sha512-XRcglhh3p2lHAu4gFg75i5owZ3/uttIZh11iKj+W2fqc4Iu8OvwIHkDSftaw4gURo0WA2fT2oguwTa4HChLwJw==",
+      "dev": true,
+      "license": "WTFPL"
+    },
+    "node_modules/@babel/core": {
+      "version": "7.22.5",
+      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.22.5.tgz",
+      "integrity": "sha512-A/7v7t3swT1cyX5u/GhFT+yzhPPSdlJHh0dfFfuBJs/T6uhVVD4namjWQM5JVWUzdCVXmbe6CY1TKJv9RAOcsw==",
+      "dependencies": {
+        "debug": "^4.1.0",
+        "semver": "^6.3.1",
+        "js-tokens": "^4.0.0",
+        "chalk": "^3.0.0 || ^4.0.0"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/babel"
+      }
+    },
+    "node_modules/js-tokens": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
+      "integrity": "sha512-fIvNBV3y6EBRV/ibHHjLBDSpRbdhtKXf61DSzOV50xIpPgfbW/5lxDDVRmx4fZwRHf77QMVfworHea2SkYxOUA==",
+      "optional": true
+    },
+    "node_modules/ansi-styles": {
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.1.tgz",
+      "integrity": "sha512-EhXoniJkJjbZMaPS9yC77u2K93fKsYbaCeSyOCRST6uRDoAjzpTgKzF+7j3yt8UFq8cS9s+2q1DnnuYgNymgMQ==",
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    }
+  },
+  "homepage": "https://github.com/orders/app#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/orders/app.git"
+  },
+  "bugs": {
+    "url": "https://gitlab.com/orders/app/-/issues"
+  },
+  "checksum": "sha512-J+kyFiBsBm/fD8hhvHNNhwAwtxrtThSi5Bex9sbmegf4MdcWwPTn+Mv/OmIAJTWuSKOctlW0Iduj4/oo6+BT9w=="
+}
+=== FINDINGS (sorted) ===

internal/goldencorpus/testdata/golden/secrets_line_veto_lockfile_decoys.sarif.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/refs/heads/main/sarif-2.1/schema/sarif-schema-2.1.0.json",
+  "runs": [
+    {
+      "results": [],
+      "tool": {
+        "driver": {
+          "informationUri": "https://github.com/awslabs/ferret-scan",
+          "name": "Ferret Scan",
+          "semanticVersion": "0.0.0-development",
+          "version": "0.0.0-development"
+        }
+      }
+    }
+  ],
+  "version": "2.1.0"
+}