# agent's secret-scan flagged its own redacted output: false-positive loop

## TL;DR
The scanner is reading the agent's own log files, where earlier redaction left [REDACTED] next to words like token, or left placeholder values the entropy check still flags. The scan keeps finding itself. Exclude the scan-output and log directories from the scan, and teach the scanner to ignore your redaction placeholders.

```text
agent's secret-scan flagged its own redacted output: false-positive loop
```

## Use this when
- The scanner flags files under your logs or reports directories
- The same finding reappears on every run with no code changes
- Redacted output still triggers entropy-based rules
- The alert points at a previous scan's output file

## Not for this skill when
- The flagged secret is real and in source code (that is a true positive, rotate it)
- You are choosing between secret scanning tools
- You are setting up pre-commit hooks for the first time

## Steps
1. Open the finding and confirm the flagged file is the agent's own log or a previous scan report, not source code.
   Expected: the flagged path sits under your logs or reports directory.
2. Add those paths to the scanner's exclude list so it never scans its own output again. With gitleaks, use the allowlist paths in the config; with trufflehog, use the exclude-paths option.
   ```toml
   [allowlist]
   paths = ["logs/", "reports/"]
   ```
   Expected: a re-scan no longer flags its own output.
3. Add your redaction placeholder text to the scanner's allowlist so neighbors of [REDACTED] stop tripping entropy rules.
   Expected: redacted lines scan clean.
4. Re-run the scanner against the real source tree and confirm true positives still fire, using the scanner's own test fixtures.
   Expected: a known test secret is still flagged, proving the scanner still works.

### Variant: gitleaks flagged my own log file
Same fix: allowlist the log path in .gitleaks.toml. If the log contains real secrets, rotate them first; excluding the path does not un-leak them.

### Variant: trufflehog false positive on redacted output
Trufflehog's entropy detectors fire on redaction-adjacent text. Exclude the output paths and lower the noise by scanning diffs instead of full history where you can.

### Variant: secret scanner keeps alerting on placeholder values
Placeholders like "changeme" or "YOUR_SECRET_HERE" in docs and examples trip pattern rules. Allowlist the exact placeholder strings, and keep that allowlist in version control so it gets reviewed.

## Why this happens
Scanners match patterns and entropy across every file they are pointed at, including the agent's own logs and previous reports. Redaction removes the secret but leaves the pattern shape behind, and the scanner happily reports its own earlier work as a new finding.

## Edge cases and pitfalls
- Do not over-allowlist: excluding too much hides real leaks. Review the allowlist like code.
- Placeholder values in docs can mask a real secret pasted next to the placeholder; eyeball the context, do not just allowlist and move on.
- Scan diffs in CI rather than full history on every run; it is faster and produces fewer self-referential hits.
- If the log that got flagged contains a real secret, the exclusion is step two; step one is rotating the secret.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_VLq4HDpyJ2v3kFnq-v2l6w