overlane egress scan | Overlane Docs

Sends the names of the files git tracks or would add (never their contents) and reports the ones that usually hold a credential: .env files, .npmrc, private keys, cloud credential files. Exits 6 when any is found. Scanning a job’s logs for a granted credential’s value happens inside the runner, not here.

Usage

overlane egress scan

Examples

overlane egress scan

Behavior

Effect: read (changes nothing).
Needs credentials: yes. Uses the network: yes.
Supports --dry-run: no. Accepts --force: no.
Machine-readable description: overlane schema egress scan.

Result

With --json (the default when stdout is not a terminal) the command prints this JSON Schema’s shape on stdout.

{
  "type": "object",
  "properties": {
    "tenantId": {
      "type": "string",
      "minLength": 1,
      "maxLength": 128,
      "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]*$",
      "description": "tenant identifier"
    },
    "projectId": {
      "type": "string",
      "minLength": 1,
      "maxLength": 128,
      "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]*$",
      "description": "project identifier"
    },
    "clean": {
      "type": "boolean"
    },
    "checkedGrants": {
      "type": "integer",
      "minimum": 0,
      "maximum": 9007199254740991
    },
    "findings": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "kind": {
            "type": "string",
            "enum": [
              "minted_value",
              "credential_pattern",
              "credential_file"
            ]
          },
          "rule": {
            "type": "string"
          },
          "place": {
            "type": "string"
          },
          "line": {
            "anyOf": [
              {
                "type": "integer",
                "minimum": -9007199254740991,
                "maximum": 9007199254740991
              },
              {
                "type": "null"
              }
            ]
          },
          "grantId": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "kind",
          "rule",
          "place",
          "line",
          "grantId"
        ],
        "additionalProperties": false
      }
    }
  },
  "required": [
    "tenantId",
    "projectId",
    "clean",
    "checkedGrants",
    "findings"
  ],
  "additionalProperties": false
}

See exit codes for the status the process returns.