Question
Why does siloscan's converted age-secret-key rule report 33 findings in the cargo-registry tree where gitleaks 8.30.1 reports 93 - and is the difference a conversion-fidelity bug?
Parent: #48
Surfaced by the first parity run (#50, 2026-08-07): the only unexplained siloscan-missing cluster after generic-api-key (deliberate exclusion) and pkcs12-file (scheduled in #53). The 60 misses cluster in the age crate's own deliberately-malformed testkit fixtures (hmac_bad, header_crlf, fail_*).
Suspects, in order: the converted entropy threshold rejecting what gitleaks accepts, the keyword prefilter, or binary-sniffing skipping fixture files gitleaks reads. Needs a per-file trace of a handful of the 60 before any rule change - and any change ships with corpus coverage and before/after counts per the map's standing rule.
Reproduce: python3 scripts/parity_gitleaks.py --siloscan target/release/siloscan --out /tmp/parity ~/.cargo/registry/src, filter the TSV for age-secret-key.*siloscan-missing.
Question
Why does siloscan's converted
age-secret-keyrule report 33 findings in the cargo-registry tree where gitleaks 8.30.1 reports 93 - and is the difference a conversion-fidelity bug?Parent: #48
Surfaced by the first parity run (#50, 2026-08-07): the only unexplained siloscan-missing cluster after generic-api-key (deliberate exclusion) and pkcs12-file (scheduled in #53). The 60 misses cluster in the age crate's own deliberately-malformed testkit fixtures (
hmac_bad,header_crlf,fail_*).Suspects, in order: the converted entropy threshold rejecting what gitleaks accepts, the keyword prefilter, or binary-sniffing skipping fixture files gitleaks reads. Needs a per-file trace of a handful of the 60 before any rule change - and any change ships with corpus coverage and before/after counts per the map's standing rule.
Reproduce:
python3 scripts/parity_gitleaks.py --siloscan target/release/siloscan --out /tmp/parity ~/.cargo/registry/src, filter the TSV forage-secret-key.*siloscan-missing.