/**
 * Secret Leakage Detector (Issue #103, Challenge #9)
 * Scans for credential patterns regardless of payload type
 *
 * Extracted from SecurityResponseAnalyzer.ts for modularity (Issue #179)
 */
import { CompatibilityCallToolResult } from "@modelcontextprotocol/sdk/types.js";
/**
 * Result of secret leakage detection
 */
export interface SecretLeakageResult {
    detected: boolean;
    evidence?: string;
}
/**
 * Detects when tools inadvertently expose secrets/credentials
 *
 * This detector identifies:
 * - API keys (AWS, OpenAI, GitHub, GitLab, Slack)
 * - Database connection strings with credentials
 * - Environment variable values
 * - Partial key previews
 *
 * @note This detector must be called separately from analyzeResponse().
 * It is not part of the standard vulnerability detection flow because
 * secret leakage detection requires examining ALL responses, not just
 * those matching attack payloads.
 */
export declare class SecretLeakageDetector {
    private safeDetector;
    /**
     * Secret patterns to detect in responses
     */
    private static readonly SECRET_PATTERNS;
    constructor();
    /**
     * Check for secret leakage in response (Issue #103, Challenge #9)
     * Scans for credential patterns regardless of payload type.
     *
     * @example
     * ```typescript
     * const detector = new SecretLeakageDetector();
     * const response = await client.callTool("get_status", { verbose: true });
     *
     * const leakResult = detector.analyze(response);
     * if (leakResult.detected) {
     *   console.warn(`Secret leaked: ${leakResult.evidence}`);
     * }
     * ```
     */
    analyze(response: CompatibilityCallToolResult): SecretLeakageResult;
}
//# sourceMappingURL=SecretLeakageDetector.d.ts.map