From 35900f8bd52f3dc66914bcbe1ad95c2e1cad81f3 Mon Sep 17 00:00:00 2001 From: malachite Date: Mon, 6 Apr 2026 18:54:11 +0000 Subject: [PATCH] docs: fix README secret pattern count and coverage list (rf-4zx) - Change "21+" to "21" throughout README and llms.txt (exactly 21 patterns exist) - Add "bearer tokens" to the coverage list in the Secret Scanning section (Bearer Token pattern was present in code and tests but missing from README) --- README.md | 8 ++++---- llms.txt | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index be647371..4e88081c 100644 --- a/README.md +++ b/README.md @@ -24,7 +24,7 @@ Rafter is a **security primitive** that any developer or agent can call and trus **Two capabilities in one package:** -1. **Local Security Toolkit** (free, no account) — Fast secret scanning (21+ built-in patterns, deterministic for a given version), policy enforcement with risk-tiered rules, pre-commit hooks, extension auditing, custom rule authoring, and full audit logging. Works offline. **No API key. No telemetry. No data leaves your machine.** Supports Claude Code, Codex CLI, OpenClaw, Gemini CLI, Cursor, Windsurf, Continue.dev, and Aider. +1. **Local Security Toolkit** (free, no account) — Fast secret scanning (21 built-in patterns, deterministic for a given version), policy enforcement with risk-tiered rules, pre-commit hooks, extension auditing, custom rule authoring, and full audit logging. Works offline. **No API key. No telemetry. No data leaves your machine.** Supports Claude Code, Codex CLI, OpenClaw, Gemini CLI, Cursor, Windsurf, Continue.dev, and Aider. 2. **Remote Code Analysis** — Deep security audits that combine agentic analysis with a full SAST/SCA toolchain. Rafter's engine examines your codebase the way a professional penetration tester would — tracing data flows, reasoning about business logic, and surfacing vulnerabilities that static rules alone miss — then cross-references findings with industry-standard SAST, SCA, and secret-detection tools. Structured reports in JSON or Markdown. Pipe to any tool, feed to any workflow. @@ -75,7 +75,7 @@ That's the core loop: scan → protect → audit. Everything works offline, no A | Feature | Free (individuals & OSS) | Enterprise | |---------|:------------------------:|:----------:| -| Secret scanning (21+ patterns) | **Yes** | Yes | +| Secret scanning (21 patterns) | **Yes** | Yes | | Pre-commit hooks | **Yes** | Yes | | Command interception | **Yes** | Yes | | Skill/extension auditing | **Yes** | Yes | @@ -190,7 +190,7 @@ Use `rafter agent list/enable/disable` for granular per-component control after ### Secret Scanning -Fast, reliable, and deterministic for a given CLI version. 21+ built-in patterns covering AWS, GitHub, Google, Slack, Stripe, Twilio, database connection strings, JWTs, private keys, npm/PyPI tokens, and generic API keys. Same inputs produce the same findings — no flaky CI, no phantom alerts. +Fast, reliable, and deterministic for a given CLI version. 21 built-in patterns covering AWS, GitHub, Google, Slack, Stripe, Twilio, database connection strings, JWTs, private keys, bearer tokens, npm/PyPI tokens, and generic API keys. Same inputs produce the same findings — no flaky CI, no phantom alerts. ```sh rafter secrets . # scan directory @@ -338,7 +338,7 @@ Config lives at `~/.rafter/config.json`. Project-level overrides via `.rafter.ym ### Custom Rules -Define your own secret patterns alongside the 21+ built-in ones. Add them to `.rafter.yml` in your project root: +Define your own secret patterns alongside the 21 built-in ones. Add them to `.rafter.yml` in your project root: ```yaml # .rafter.yml diff --git a/llms.txt b/llms.txt index faed6bda..0fd76c09 100644 --- a/llms.txt +++ b/llms.txt @@ -25,7 +25,7 @@ Rafter is the security layer between your agent and your codebase. Install it be ## Agent Security Features (Free, No Account, Works Offline) -- **Secret scanning**: 21+ built-in patterns (API keys, tokens, credentials), deterministic detection, zero external dependencies. Optional Gitleaks integration for deeper coverage. Secrets are redacted in all output. +- **Secret scanning**: 21 built-in patterns (API keys, tokens, credentials), deterministic detection, zero external dependencies. Optional Gitleaks integration for deeper coverage. Secrets are redacted in all output. - **Command interception**: Risk-tiered approval system (critical/high/medium/low) wrapping shell commands executed by agents. Configurable policies: allow-all, approve-dangerous (default), deny-list. - **Policy enforcement**: Project-level `.rafter.yml` files define custom secret patterns, command rules, and risk levels. Policies travel with the repo. - **Extension auditing**: Audit third-party agent skills, extensions, and MCP tools for embedded secrets, malicious URLs, and risky command patterns before enabling them. @@ -38,7 +38,7 @@ Rafter is the security layer between your agent and your codebase. Install it be - `rafter agent init --all` — Set up security across all detected agent platforms in one command - `rafter agent init-project` — Generate per-repo instruction files for agents (CLAUDE.md, AGENTS.md, etc.) -- `rafter secrets .` — Scan a directory for secrets (21+ patterns, deterministic, offline) +- `rafter secrets .` — Scan a directory for secrets (21 patterns, deterministic, offline) - `rafter secrets --staged` — Scan git staged files before committing - `rafter agent exec "command"` — Execute a shell command through the policy enforcement layer - `rafter agent audit --last 20` — Review recent security audit log entries