Skip to content

1.1.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Oct 20:01
· 4 commits to main since this release
Immutable release. Only release title and notes can be modified.
1.1.0
This tag was signed with the committer’s verified signature.
hbenali Houssem Ben Ali
SSH Key Fingerprint: xOCXKkxuU9SZpWrXxETWsXX5MldLDAehWb5cedtWMHk
Verified
Learn about vigilant mode.
cd06e34
This commit was signed with the committer’s verified signature.
hbenali Houssem Ben Ali
SSH Key Fingerprint: xOCXKkxuU9SZpWrXxETWsXX5MldLDAehWb5cedtWMHk
Verified
Learn about vigilant mode.

More secrets and personal data caught, reports for CI, a safer web UI, and much easier to install and adopt. No 1.0 flag, exit code or output format changed.

Heads-up (new default-on detectors). Provider tokens, cookies, IBANs and user names in home-directory paths are on by default, so logs that were clean under 1.0 can now contain matches (for example /home/alice/... becomes /home/[REDACTED:home-path]/...; /home/runner and similar role accounts are left alone). --disable ID restores the old behaviour for any of them; --check shows what changed.

New detectors: Docker Hub, Anthropic, OpenAI, Google, npm, PyPI, SendGrid, Hugging Face, Shopify, DigitalOcean, Vault, age, Telegram and Azure storage keys; Cookie / Set-Cookie values; session_id and credentials fields; IBANs (checksum-verified); home-directory user names. Opt-in: us-ssn, mac-address, high-entropy. Throughput is unchanged (about 10 MB/s). Reference: the wiki's Detectors page.

CI and reporting: --report-format json|sarif (file, line, byte range; never the matched text; SARIF 2.1.0 works with code scanning); --output/-o writes atomically with mode 0600 and refuses to overwrite its input; a per-user config file ($XDG_CONFIG_HOME/logscrub/config.toml) is read unless world-writable, and a config in the current directory is deliberately never read (an allow-list in an untrusted checkout could make logscrub leak).

Web UI: --allow-remote now requires an access token (generated and printed in a URL fragment, or --token-file / LOGSCRUB_TOKEN), compared in constant time. The result tabs are keyboard operable and an axe-core audit finds zero violations in light, dark and mobile layouts.

Install and adopt: .deb, .rpm and .apk packages (amd64 and arm64) with the man page and shell completions; logscrub completion bash|zsh|fish; a man page; a GitHub Action (uses: hbenali/logscrub@1.1.0, verifies the release checksum) and a pre-commit hook; archives now include the licence, man page and completions.

Supply chain: every archive and package has its own build-provenance attestation: gh attestation verify FILE --repo hbenali/logscrub. The image is on Docker Hub (hbenali/logscrub) and GHCR with an identical digest.

Tested on Linux, macOS and Windows in CI, the packages in Debian, Fedora and Alpine containers, the arm64 image under QEMU, and the web UI in a real browser. Not tested: zsh and fish completions beyond a syntax check, and screen-reader use of the web UI.

Pattern matching cannot find secrets with no recognisable shape; review the output before sharing it.

Assets 16
Loading