feat: H shows what's hidden; Spring keys that don't look secret are hidden
CI / Checks (pull_request) Successful in 39s
PR title / Conventional title (pull_request) Successful in 1s

Sources, files and secrets get a Hidden flag. The repo provider marks
Spring keys that match neither pattern, files with only those, and repos
with only such files, instead of leaving them out.

- Hidden items are left out of the panes, Go to and lazysecrets list;
  a pane's counter says how many it hides.
- H (lists.toggleHidden) shows them, dimmed whole in mutedColor;
  list --hidden lists them, json marks them "hidden".
- A revealed empty value shows "∅ no value (an empty string)", muted,
  instead of a blank line.
This commit is contained in:
keb committed 2026-10-15 13:43:37 +02:00
1 parent 17da9eaa32
commit dbe4fbeb5f
19 files changed
+323 -74

No files matched your search

+7 -4
View File
@@ -69,7 +69,8 @@ sharing:
`application.yml`, `application-prod.properties`, `bootstrap.yaml` and the
like, tracked by git (not those in a Helm chart's `templates/`). Most of
their keys aren't secret, so only those that look like one are listed:
their keys aren't secret, so only those that look like one are listed; the
rest are hidden:
- **keys** named like a secret: ending in `password`, `pwd`, `secret`,
`token`, `key`, `credentials`, `salt`, `connection-string` and the
@@ -78,9 +79,11 @@ their keys aren't secret, so only those that look like one are listed:
password (`jdbc:postgresql://app:pw@db/app`), or a connection string
with `AccountKey=`, `SharedAccessKey=` or `Password=`.
A file's details count the keys left out, and `e` opens it whole. A
`${DB_PASSWORD}` value is marked as a reference: the secret is set
elsewhere. A tracked file is marked in red only when a listed key has its
A file with none is hidden too, and a repo with only such files. `H` shows
what's hidden, dimmed, in the panes and in Go to (`lazysecrets list
--hidden` lists it); a pane's counter says how many it hides. A file's
details count its hidden keys, and `e` opens it whole. A `${DB_PASSWORD}`
value is marked as a reference: the secret is set elsewhere. A tracked file is marked in red only when a listed key has its
value in plain text.
Each list of regexps replaces its default; `keys: [".*"]` lists every key: