SFT / 01

Local-only review tool

See the context.
Not the secret.

Turn scanner output into evidence your team can safely discuss: line-numbered context, an irreversible mask, structural clues, and a signed decision trail.

Install the CLI Try a safe fixture
  • No uploads
  • No telemetry
  • Open-source core
A paper evidence sheet with black redaction bars fixed to a cracked concrete workbench where moss grows
Fig. 01 Context remains. Matched material does not.

Scanner in. SARIF or Gitleaks JSON.

Masked evidence out. HTML, Markdown, signed JSON.

01 / Boundary

A smaller blast radius for review.

  1. 1

    Read locally

    The CLI resolves scanner paths inside the repository root. Paths that escape it are refused.

  2. 2

    Mask first

    The matched span becomes a fixed marker before the report model or renderer can see it.

  3. 3

    Decide with clues

    Review line context, type, length, character classes, and entropy—then sign the resolution.

Important: classification can tell you whether a finding looks deliberate or risky. It cannot prove a credential is valid, revoked, or inactive.

02 / Live workbench

Mask a fixture in this browser.

This demo never sends, saves, or logs its inputs. For real findings, use the CLI inside the repository.

Local demo ready

Source context

Stays in this tab

generic-api-key

src/config.ts:3

Needs review

            
Browser demo · never persisted

          

        

      


      

        
03 / Install
One binary. No service account.
Build from source today. Release binaries are prepared for factory publishing.

        

          
LOCAL / REPOSITORY

          
$ cargo install --git https://github.com/B-Divyesh/sf-secret-finding-triage

$ sft render --input results.sarif --repo . --output triage.html
Rendered 12 of 12 findings to triage.html.

        

        

          
SARIF 2.1
Scanner-neutral
Reads physical locations from standard SARIF runs and results.

          
Gitleaks JSON
Works as emitted
Understands familiar RuleID, File, line, column, Secret, and Fingerprint fields.

          
.sft.toml
Repository policy
Exclude fixtures, vendored trees, generated output, or any project-specific path.

        

      


      

        
04 / Team workflow
Keep the core free. Make the review repeatable.
The CLI, safe masking, all export formats, and signed records are free. A one-time Team Workflow Pack adds a reusable policy worksheet, reviewer rubric, and priority product updates.
  • Review rubric for confirmed, fixture, accepted-risk, and needs-context decisions
  • Repository policy worksheet with copy-ready `.sft.toml` profiles
  • Priority updates for this major version