Use a token format with a prefix
- Dominant language
- PHP
- Stars
- 1.8k
- Forks
- 488
- Avg merge
- 2d 21h
- Merged PRs (30d)
- 32
Description
Private Packagist uses a [token format with a prefix and checksum](https://packagist.com/docs/composer-authentication#token-format) to help with automated scanning for commited secrets in codebases.
For an example, see [Trivy: Secret scanning](https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret/) and https://github.com/aquasecurity/trivy/pull/7826.
Doing the same for Packagist.org would allow those secret scanners to scan for Packagist.org tokens as well.
Contributor guide
No contributing guide indexed for this repository
Research direction
No files, tests, or entry points are named. Start by reviewing the linked Private Packagist token format and Trivy secret-scanning example, then trace how Packagist.org tokens are issued and validated. Done should mean a documented, compatible prefixed format with checksum support and coverage for the relevant token behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100