feat: corpus-driven generic secret rules, cache permissions, report integrity (1.5.0)

[aksOps]

Closes seven confirmed blockers from the independent v1.4.1 production gate, plus the false-positive regression the fix itself introduced.

Root cause

siloscan's vendor-prefixed detection was already excellent - 5/5 GitHub variants, 10/10 across major vendors, 5/5 private key formats. The generic safety net beneath it was four regexes written in one pass against no corpus, and it had structural holes: every exactly-40-character secret was allowlisted (killing GitHub OAuth client secrets), passwords with punctuation were unmatchable, the identifier allowlist widened in 1.4.1 swallowed ~20% of base64url tokens, Authorization headers were unmatched outside curl, empty-username URLs (the canonical Redis form) were never reported, and 1.4.1's placeholder fix reached only the URL rule despite its commit message.

The fix is not seven patches. It is a committed detection corpus - 21 files, 172 positives, 121 individually justified negatives - and a harness that measures recall and precision as tests. The rules were then rebuilt against it. Recall on generic shapes went 0.5814 to 0.9884; precision holds at 1.0000.

The regression this caught

The first rewrite traded precision for recall: findings on 1.8 GB of published Rust and C source went 325 to 1222, with ~870 indefensible - numeric constants (PPPIOCSPASS: u32 = 2148561991), C identifiers matched on a bare 'pass' substring (addrBypass), and every Rust scope-resolution path (Literal::u8_unsuffixed). The corpus could not see it: 21 configuration files, no C amalgamations, no generated bindings. Adversarial review caught it and it was fixed to 410 - the two rebuilt rules went from 324 and 569 findings on that tree down to 4 and 77, while both real credentials in it are still reported. The +85 versus the 1.4.1 baseline is entirely vendor rules with fixed shapes (private-key, age-secret-key), not generic-rule noise.

Review also found a genuinely subtle bug: under (?i) the regex crate case-folds the Unicode terminator class onto k/K (U+212A KELVIN SIGN), a-ring (U+212B) and sharp-s (U+1E9E), all of which are value characters - so a value simultaneously continued and terminated at the same byte, producing truncated spans and double reports.

Security

The relocated per-user cache was created with the process umask: world-readable at the default (and a cache entry is an inventory of a private tree - paths, rule ids, line and column, each secret's byte length), and world-writable under a permissive umask with .salt validated by mode only, no ownership check, restoring the tag-forging primitive the 1.4.0 relocation removed. Directories are now created 0700 and files 0600 explicitly, with ownership and mode enforced on open; an untrusted cache is ignored (cold, correct scans) rather than repaired or errored.

Also

• --min-severity is stated in human output and the TUI when it withholds findings, so a filtered report cannot read as clean.
• regex: rules gain an opt-in 'redact' switch; secret: matches were already redacted.
• The corpus is excluded from the published crate - it was shipping tests/corpus/tree/.env inside siloscan-core.
• README gains an honest Detection coverage section with the measured recall, and eight documentation claims that contradicted the code were corrected.

Verification

• 903 workspace tests; clippy -D warnings, fmt, MSRV clean.
• All seven blockers re-verified against a release build with commands run, not asserted.
• False positives: 410 on the cargo registry (byte-identical before and after the final cleanup), 0 on a real Next.js app, 1 in its node_modules, 12 on this workspace - all matching or below baseline.
• Determinism byte-identical across 1/4/8 workers x cold/warm/no-cache; fingerprints on pre-existing findings unmoved.