Repository navigation
decision(atlas): trufflehog adoption — AGPL collision + verification exfiltration; gitleaks-first ruling #6050
Description
Parent: #6021 (classification revalidation scan). Research source: prior-art doc ~/workspace/scratch/atlas-ingestion-brief-2026-11-04/prior-art-research.md (2026-11-04). Follow-up 29 (Cluster 5).
Decision to record (research, in substance)
trufflehog is the broader secret scanner (more sources + live credential verification), but for Atlas it carries two structural problems:
- License: trufflehog is AGPL-3.0, which collides with Drew's 2026-10-24 adoption hard filter ("NOT AGPL, NOT GPL") for our own dependencies. Adopting it needs the adoption-vs-use question answered deliberately, not by drift.
- Exfiltration: verification is on by default and calls external vendor APIs with candidate secrets. Inside a secret-tier scan, that behavior would exfiltrate the very material being hunted. Any use must be
--no-verificationonly.
Ruling proposed by the research: gitleaks-first (MIT, fully local); trufflehog, if ever, only with --no-verification and only after the license question is answered on the record (the adoption/upload regime distinction is being worked in the licensing family, #5977/#5984/#5986).
Done looks like
The decision recorded here (adopt the ruling or amend it), so the classification scanner design (under #6021) builds on gitleaks-class tooling by default.
Activity
developing-today commentedon Nov 5, 2026
CODE-1715
developing-today commentedon Nov 5, 2026
🤖 Agent note · handed off
dezren39 commentedon Nov 5, 2026
🤖 Agent note · handed off
opencode, so this task is handed off; the laptop claimant launches the bound opencode session which drives it to its terminal state.72 remaining items
dezren39 commentedon Nov 6, 2026
agent-note:v1
dezren39 commentedon Nov 6, 2026
agent-note:v1
Triage decision
Adopt the proposed gitleaks-first ruling for Atlas. Do not adopt trufflehog as a project dependency: the settled adoption ruling on #5984 treats GPL/AGPL as a hard reject for our own dependencies. Keep that separate from the unresolved/independent policy for user-uploaded content.
The scanner design already records the relevant operational boundary on #6021: use a gitleaks-class MIT, fully local deterministic scan; do not send candidate secrets to vendor verification APIs. If trufflehog is ever considered for a separately approved, non-dependency use, its verification must be disabled (
--no-verification) and that exception must be assessed explicitly before use against Atlas data.This resolves #6050's decision-record purpose and gives #6021 a default. #6021 remains the execution/design consumer; no duplicate follow-up queue task is needed. The repo's primary clone had pre-existing user changes, so it was not fast-forwarded; the clean task worktree was based on fetched origin/main at 2fac2b7.