Skip to content

docs: fix README secret pattern count and coverage list (rf-4zx) #73

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Rome-1 wants to merge 1 commit into from
Closed

docs: fix README secret pattern count and coverage list (rf-4zx) #73

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ Rafter is a **security primitive** that any developer or agent can call and trus

**Two capabilities in one package:**

1. **Local Security Toolkit** (free, no account) — Fast secret scanning (21+ built-in patterns, deterministic for a given version), policy enforcement with risk-tiered rules, pre-commit hooks, extension auditing, custom rule authoring, and full audit logging. Works offline. **No API key. No telemetry. No data leaves your machine.** Supports Claude Code, Codex CLI, OpenClaw, Gemini CLI, Cursor, Windsurf, Continue.dev, and Aider.
1. **Local Security Toolkit** (free, no account) — Fast secret scanning (21 built-in patterns, deterministic for a given version), policy enforcement with risk-tiered rules, pre-commit hooks, extension auditing, custom rule authoring, and full audit logging. Works offline. **No API key. No telemetry. No data leaves your machine.** Supports Claude Code, Codex CLI, OpenClaw, Gemini CLI, Cursor, Windsurf, Continue.dev, and Aider.

2. **Remote Code Analysis** — Deep security audits that combine agentic analysis with a full SAST/SCA toolchain. Rafter's engine examines your codebase the way a professional penetration tester would — tracing data flows, reasoning about business logic, and surfacing vulnerabilities that static rules alone miss — then cross-references findings with industry-standard SAST, SCA, and secret-detection tools. Structured reports in JSON or Markdown. Pipe to any tool, feed to any workflow.

Expand Down Expand Up @@ -75,7 +75,7 @@ That's the core loop: scan → protect → audit. Everything works offline, no A

| Feature | Free (individuals & OSS) | Enterprise |
|---------|:------------------------:|:----------:|
| Secret scanning (21+ patterns) | **Yes** | Yes |
| Secret scanning (21 patterns) | **Yes** | Yes |
| Pre-commit hooks | **Yes** | Yes |
| Command interception | **Yes** | Yes |
| Skill/extension auditing | **Yes** | Yes |
Expand Down Expand Up @@ -190,7 +190,7 @@ Use `rafter agent list/enable/disable` for granular per-component control after

### Secret Scanning

Fast, reliable, and deterministic for a given CLI version. 21+ built-in patterns covering AWS, GitHub, Google, Slack, Stripe, Twilio, database connection strings, JWTs, private keys, npm/PyPI tokens, and generic API keys. Same inputs produce the same findings — no flaky CI, no phantom alerts.
Fast, reliable, and deterministic for a given CLI version. 21 built-in patterns covering AWS, GitHub, Google, Slack, Stripe, Twilio, database connection strings, JWTs, private keys, bearer tokens, npm/PyPI tokens, and generic API keys. Same inputs produce the same findings — no flaky CI, no phantom alerts.

```sh
rafter secrets . # scan directory
Expand Down Expand Up @@ -338,7 +338,7 @@ Config lives at `~/.rafter/config.json`. Project-level overrides via `.rafter.ym

### Custom Rules

Define your own secret patterns alongside the 21+ built-in ones. Add them to `.rafter.yml` in your project root:
Define your own secret patterns alongside the 21 built-in ones. Add them to `.rafter.yml` in your project root:

```yaml
# .rafter.yml
Expand Down
4 changes: 2 additions & 2 deletions llms.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ Rafter is the security layer between your agent and your codebase. Install it be

## Agent Security Features (Free, No Account, Works Offline)

- **Secret scanning**: 21+ built-in patterns (API keys, tokens, credentials), deterministic detection, zero external dependencies. Optional Gitleaks integration for deeper coverage. Secrets are redacted in all output.
- **Secret scanning**: 21 built-in patterns (API keys, tokens, credentials), deterministic detection, zero external dependencies. Optional Gitleaks integration for deeper coverage. Secrets are redacted in all output.
- **Command interception**: Risk-tiered approval system (critical/high/medium/low) wrapping shell commands executed by agents. Configurable policies: allow-all, approve-dangerous (default), deny-list.
- **Policy enforcement**: Project-level `.rafter.yml` files define custom secret patterns, command rules, and risk levels. Policies travel with the repo.
- **Extension auditing**: Audit third-party agent skills, extensions, and MCP tools for embedded secrets, malicious URLs, and risky command patterns before enabling them.
Expand All @@ -38,7 +38,7 @@ Rafter is the security layer between your agent and your codebase. Install it be

- `rafter agent init --all` — Set up security across all detected agent platforms in one command
- `rafter agent init-project` — Generate per-repo instruction files for agents (CLAUDE.md, AGENTS.md, etc.)
- `rafter secrets .` — Scan a directory for secrets (21+ patterns, deterministic, offline)
- `rafter secrets .` — Scan a directory for secrets (21 patterns, deterministic, offline)
- `rafter secrets --staged` — Scan git staged files before committing
- `rafter agent exec "command"` — Execute a shell command through the policy enforcement layer
- `rafter agent audit --last 20` — Review recent security audit log entries
Expand Down
Loading