Building Dotguard: What Writing Detection Rules Taught Me About Developer Habits

Description and use

dotguard is a single‑file, zero‑dependency secret scanner that integrates into CI with one line. It detects real secret patterns, manages false positives, and encourages rotation, turning detection into a team habit.

Problem

Teams often miss or mishandle secrets, leading to costly leaks. Existing scanners either lack trust, generate false positives, or are hard to integrate into CI.

Outcome

dotguard enabled teams to detect secrets quickly, reduce false positives, and enforce rotation through a simple CI step, turning secret management into a repeatable habit.

Workflow

• 1. Add dotguard to the repository as a single file. 2. Commit a pre‑push or CI step that runs npx @wuchunjie/dotguard --report. 3. On each push, the scanner outputs a JSON report of findings. 4. Review the report: file, line, rule, severity. 5. Verify each finding; if real, rotate the key. 6. Update the suppression list for known false positives. 7. Re‑run the scan to confirm rotation and absence of the old key.

Evidence

The scanner looks for the patterns that real secrets actually take… It also checks for high‑entropy strings assigned to suspicious variable names…

Source

The entire CI integration is one step: a run line that invokes the scanner via npx… Every push gets a full scan, and the build fails if a secret is found…

Source