Scanners and detections
A Code Security scan runs several scanners over your repository and merges their results into one set of findings. Each finding shows which tool produced it.
| Scanner | What it covers |
|---|---|
| Opengrep (Oneleet rules) | Oneleet’s own curated ruleset: JavaScript and TypeScript (including Node.js and React), Python, PHP, Ruby, Rust, Go, shell scripts, HTML, GitHub Actions workflows, and npm lockfiles |
| Gosec | Go-specific security analysis |
| Bandit | Python-specific security analysis |
| Gitleaks | Leaked secrets and credentials, in any language or file type |
| Oneleet checks | Custom checks written by Oneleet, such as the npm ignore-scripts hardening check |
The Oneleet ruleset
Section titled “The Oneleet ruleset”Opengrep is a fork of Semgrep, the popular pattern-based static analysis engine. We maintain our own set of Opengrep rules that we tune for low false positive rates. Each rule has a severity level and a confidence level, and most ship with a written description and remediation guidance that appear on the issue page.
Example detections include:
- TLS certificate verification turned off
- Shell injection in GitHub Actions workflows, where untrusted
${{ github.* }}input is interpolated intorun:steps (a very common attack vector for open-source projects) - npm projects that allow packages to run lifecycle scripts on install, leaving them unnecessarily vulnerable to common supply chain attacks
Rules are added and tuned continuously. When real-world results show a rule is noisier than expected, we lower its confidence or disable it outright. If a rule keeps producing false positives in your codebase, please tell us! You can also ignore rules you don’t find valuable.
Rule IDs
Section titled “Rule IDs”Every Oneleet rule has a stable, readable ID such as javascript.language.eval.dynamic-code or python.tls.requests-module.no-cert-verification. These IDs appear on issue pages and are what you reference in ignore rules. Other scanners keep their native IDs (for example Gosec’s G402 or Gitleaks’ generic-api-key).
Secrets detection
Section titled “Secrets detection”Gitleaks scans every file for committed credentials such as cloud provider keys, access tokens, private keys, and generic high-entropy strings that look like secrets. Scans cover the code as checked out at scan time, not your full git history.
The secret value itself is redacted before results leave the scanner, and Oneleet never stores it. A finding tells you the file, line, and the kind of secret detected. To see the value, open the file at that location.
Secret findings are always High severity. A leaked credential is directly usable by an attacker, so there’s no judgment call to make.
If the finding is a real secret, treat it as compromised. Rotate it first, then remove it from the code. The next scan resolves the finding automatically once it’s gone. If it’s not a real secret (a test fixture, a placeholder), resolve it as a false positive or suppress it with a .gitleaksignore entry.