Review & Secret Scanning | Ghostable CLI 3.x | Ghostable                              Menu

 Review & Secret Scanning

   What review checks
------------------

`ghostable review` combines two local checks:

- **ENV state drift** finds environment references added in changed code and compares them with encrypted values, schema files, `.env.example`, and signed Ghostable records.
- **Hard-coded secret scanning** looks for likely credentials in changed files and redacts matching values by default.

 ENV reference detection covers common patterns in PHP/Laravel, JavaScript/TypeScript/Node, Go, Python, Ruby/Rails, Java, C#, Rust, Swift, and shell or deployment scripts. GitHub Actions environment references under `.github/` are ignored because they often refer to GitHub Secrets or Variables.

 Git comparison
--------------

 Without `--base`, Ghostable tries the current branch upstream, then `origin/main`, `origin/master`, `main`, `master`, and finally `HEAD`. The head includes local worktree changes by default.

 Review a pull request range     Copy

 ```
$ ghostable review --base origin/main --head HEAD
$ ghostable review app/ config/ --base origin/main

```

 Focused review modes
--------------------

 Focused review     Copy

 ```
$ ghostable review --env-only
$ ghostable review --secrets-only
$ ghostable scan

```

`scan` remains a compatibility command for the hard-coded secret scanner. Prefer `review --secrets-only` in new scripts.

  Avoid --show-values

 `--show-values` can print matching plaintext. It is for deliberate human debugging, not CI, copied issue reports, or coding-agent sessions.

 Scan configuration
------------------

 The project manifest sets the default scan level to `standard` and ignores Git metadata, dependencies, build output, encrypted value files, and environment key files. Override a run with `--level relaxed|standard|strict`, repeated `--ignore` patterns, or `--max-size`.

 Output formats
--------------

 Machine-readable review     Copy

 ```
$ ghostable review --format github
$ ghostable review --json
$ ghostable review --secrets-only --json

```

Use GitHub format for annotations in Actions and JSON for other automation.

 Suppressions
------------

Create a signed, scoped, optionally expiring suppression only after reviewing a false positive:

 Suppress a reviewed finding     Copy

 ```
$ ghostable review suppress --code  --path tests/Fixtures/token.php --line 14 --reason "Documented test fixture" --expires-in 30d

```

Suppression records are repository-visible policy decisions. Prefer narrow path, line, kind, key, and expiration scopes over broad permanent exclusions.

    On this page

    [ ![Ghostable](https://ghostable.dev/images/logo-dark.svg) ![Ghostable](https://ghostable.dev/images/logo-light.svg) ](https://ghostable.dev)

   CLI 3.x     [   CLI 3.x ](https://ghostable.dev/docs/3.x) [   Desktop ](https://ghostable.dev/docs/desktop)

  CLI 3.x introduction Documentation local first no login encrypted repository plaintext hosted service

  Installation Documentation brew homebrew npm npx linux windows PATH version update

  Start a new project Getting Started setup seed dotenv owner initialize

  Adopt an existing project Getting Started existing env import authoritative source adopt

  Onboard a team member Getting Started join request approve roles offboarding pull request

  Repository and storage Core Concepts .ghostable git conflict merge worktree private identity metadata

  Environments Core Concepts protected production preview staging push sync pull replace run mask-output

  Variables and promotions Core Concepts var promote copy context annotation key

  Access and devices Core Concepts identity reader writer grantor owner revoke rotate leave delete

  Daily development workflow Workflows pull diff validate review clean daily

  Review and secret scanning Workflows scan sarif github suppress secrets drift

  Hygiene and rotation Workflows rotation stale unused suppression environment key

  Automation credentials Automation & CI GHOSTABLE\_CI\_TOKEN ci deploy credential powershell revoke replace

  Continuous integration Automation & CI GitHub Actions fork pull request JSON stdout stderr exit codes mask-output

  Deployments Automation & CI Forge Vapor Cloud provider CLI dry-run preserve remote keys temporary files

  Validation Reference schema required nullable regex min max different\_from

  Command reference Reference --help --json NO\_COLOR flags aliases exit code automation

  Configuration Reference ghostable.yaml activity mode auditEnvironments scan ignores deployTarget dotenv syntax

  Security Reference cryptography XChaCha20 Poly1305 HKDF user presence threat model

  Backups & Offline Reference recovery offline restore clone key identity

  Agent integration Reference AGENTS.md capabilities allowlist coding agent

  Troubleshooting Reference no project found revoked identity stale policy user presence invalid CI token provider CLI git conflict diagnostics

  Ghostable Desktop overview Desktop

  Installation Desktop

  Projects and setup Desktop

  Interface tour Desktop

  Environments and variables Desktop

  Local environment files Desktop

  Validation and review Desktop

  Activity Desktop

  Access and automation Desktop

  Project settings Desktop

  Application settings Desktop

  Licensing and updates Desktop

  Security and storage Desktop

  Troubleshooting Desktop    No results found