Appending to allowed literal will pass the check

[spinwang]

I ran the following to add somethingsecret as an allowed password in literal form:

git secrets --add 'password\s*=\s*.+'
git secrets --add --allowed --literal 'somethingsecret'

But I found that password=somethingsecret1, will also pass the check.

[mtdowling]

This looks like it's working as intended.

Allowed patterns are evaluated after checking for prohibited patterns. git-secrets will first identify that "password=somethingsecret1" is prohibited. It will then pipe the matching grep output for that line to another grep that checks for allowed patterns. If any of the allowed patterns match, then the text that was found is ignore.

I don't know what you're trying to do, but one way to mitigate these kinds of situations is to be more specific with your allowed patterns.

[spinwang]

@mtdowling I think I misunderstood the syntax. Thanks!!