Class BaseDetectorAbstract

Protected Abstract ReadonlytrapType

ProtectedredactEvidence

• redactEvidence(match: string): string

  Last chance to alter matched text before it becomes Threat.evidence.

  Evidence travels: into ScanResult, the CLI's JSON/SARIF output, audit records, and whatever the caller logs. For most detectors the matched text IS the finding and must be preserved verbatim. For a detector whose matches are themselves secrets, echoing them would leak the credential into exactly the CI logs and audit trails the scan was meant to protect. Override to redact; the default is identity.

  Sanitization is unaffected — it works from Threat.location, not evidence.

  Parameters

  • match: string

  Returns string