TealSecrets

pip install tealtiger

import asyncio
from tealtiger import TealEngine, TealSecrets

engine = TealEngine(
    policy={
        "secrets": {
            "enabled": True,
            "confidence_threshold": 0.8,
        }
    },
    modules=[TealSecrets()],
)

async def main():
    decision = await engine.evaluate(
        request={"content": "My API key is sk-proj-abc123def456..."},
        ctx={"correlation_id": "req-001"},
    )

    print(decision.action)    # "DENY"
    for finding in decision.findings:
        print(f"{finding.type}: confidence={finding.confidence}")

asyncio.run(main())

from dataclasses import dataclass

@dataclass
class SecretFinding:
    finding_id: str        # Unique finding identifier
    type: str              # e.g., "openai_api_key"
    category: str          # e.g., "api_keys", "tokens"
    confidence: float      # 0.0 – 1.0
    severity: str          # "critical" | "high" | "medium" | "low"
    fingerprint: str       # SHA-256 hash (never the actual secret)

engine = TealEngine(
    policy={
        "secrets": {
            "enabled": True,
            "confidence_threshold": 0.8,
            "categories": ["api_keys", "tokens", "credentials", "certificates"],
            "actions": {
                "critical": "DENY",
                "high": "DENY",
                "medium": "REDACT",
                "low": "ALLOW",
            },
        }
    },
    modules=[TealSecrets()],
)

decision = await engine.evaluate(
    request={
        "content": """
        Here are the deployment credentials:
        AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
        AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
        """
    },
    ctx={"correlation_id": "scan-001"},
)

# decision.action == "DENY"
# decision.findings == [
#   SecretFinding(type="aws_access_key", category="cloud_secrets", confidence=0.95, ...),
#   SecretFinding(type="aws_secret_key", category="cloud_secrets", confidence=0.98, ...),
# ]
# decision.reason_codes == ["SECRET_DETECTED", "CREDENTIAL_LEAKAGE"]

engine = TealEngine(
    policy={
        "secrets": {
            "enabled": True,
            "confidence_threshold": 0.8,
            "actions": {"critical": "REDACT", "high": "REDACT"},
        }
    },
    modules=[TealSecrets()],
)

decision = await engine.evaluate(
    request={"content": "Token: ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"},
    ctx={"correlation_id": "scan-002"},
)

# decision.action == "REDACT"
# decision.metadata["redacted_content"] == "Token: [REDACTED:github_pat]"