parseEnvFile splits on \n and scanContent matches known secrets with content.includes(value). A multiline credential — most commonly a PEM private key (-----BEGIN PRIVATE KEY----- … multiple lines …) — stored in ~/.env cannot be parsed as a single value, so it is never registered as a known secret. The secret-shaped heuristic is also line-based.
Impact: a committed multiline private key is not detected by --check.
Proposed fix: support multiline values when parsing the root env, and/or add a dedicated detector for PEM key blocks regardless of ~/.env. Add must-detect tests for PEM blocks.
Surfaced during test-suite hardening for the --check feature (#14 / #24).
parseEnvFilesplits on\nandscanContentmatches known secrets withcontent.includes(value). A multiline credential — most commonly a PEM private key (-----BEGIN PRIVATE KEY-----… multiple lines …) — stored in~/.envcannot be parsed as a single value, so it is never registered as a known secret. The secret-shaped heuristic is also line-based.Impact: a committed multiline private key is not detected by
--check.Proposed fix: support multiline values when parsing the root env, and/or add a dedicated detector for PEM key blocks regardless of
~/.env. Add must-detect tests for PEM blocks.Surfaced during test-suite hardening for the
--checkfeature (#14 / #24).