Describe the bug
The entropy scanner (src/ghostcheck/checks/entropy_scanner.py) flags long hyphenated strings (e.g. some-common-utility-class-name-long) as high-entropy secrets if they match a certain length threshold.
Since Shannon entropy measures character variety, long dash-separated words (common in UI styling, CSS classes, or markdown tables) can sometimes exceed the entropy threshold and trigger false positives. We need to implement a pre-check or exclusion regex to avoid scanning strings that consist purely of common English words or typical CSS/HTML kebab-case naming patterns.
Steps to reproduce
- Add a file with a long hyphenated string like
class="bg-gradient-to-r-from-indigo-to-purple-ui-container".
- Run
ghostcheck scan.
- The string gets flagged as a high-entropy secret.
Expected behavior
The entropy scanner should ignore strings matching kebab-case patterns composed of common dictionary words, or apply negative lookaheads/exclusion lists to prevent polluting the scan report.
Describe the bug
The entropy scanner (
src/ghostcheck/checks/entropy_scanner.py) flags long hyphenated strings (e.g.some-common-utility-class-name-long) as high-entropy secrets if they match a certain length threshold.Since Shannon entropy measures character variety, long dash-separated words (common in UI styling, CSS classes, or markdown tables) can sometimes exceed the entropy threshold and trigger false positives. We need to implement a pre-check or exclusion regex to avoid scanning strings that consist purely of common English words or typical CSS/HTML kebab-case naming patterns.
Steps to reproduce
class="bg-gradient-to-r-from-indigo-to-purple-ui-container".ghostcheck scan.Expected behavior
The entropy scanner should ignore strings matching kebab-case patterns composed of common dictionary words, or apply negative lookaheads/exclusion lists to prevent polluting the scan report.