/**
 * Security scan commands — code/dependency scanning and secret detection
 */
export declare const SECRET_PATTERNS: Array<{
    pattern: RegExp;
    type: string;
}>;
/**
 * File extensions the secret scanner reads. Previously limited to
 * ts/js/json/yml/yaml(+.env*), which meant any other language — Python, Go,
 * Ruby, shell, etc. — was silently invisible to `security scan`/`secrets`
 * regardless of what it contained. Broadened to cover common source/config
 * file types actually likely to hold hardcoded credentials.
 */
export declare const SECRET_SCAN_EXTENSIONS: RegExp;
/**
 * File extensions the code-pattern scanner (eval(), innerHTML, command
 * injection, SQL injection, ...) reads. Previously ts/js/tsx/jsx only, so a
 * dangerous `eval()` call in a Python, shell, or Ruby file was never seen.
 */
export declare const CODE_PATTERN_SCAN_EXTENSIONS: RegExp;
export type SecretFinding = {
    severity: string;
    type: string;
    location: string;
    description: string;
    rawSeverity?: 'critical' | 'high' | 'medium' | 'low';
};
/**
 * Records what the scanner could NOT look at.
 *
 * Without this the scanner swallowed unreadable directories and stopped at its
 * depth limit, then printed "No secrets found." — an error presented as a clean
 * result. Callers must consult `scanWasIncomplete()` before reporting a clean
 * bill of health.
 */
export interface ScanCoverage {
    /** Directories that could not be listed (permissions, I/O). Real failures. */
    unreadableDirs: string[];
    /** Files that could not be read or stat'd. Real failures. */
    unreadableFiles: string[];
    /** Directories not descended into because the depth limit was reached. */
    depthTruncatedDirs: string[];
    /** Files skipped because they exceed the 1MB per-file cap. */
    oversizedFiles: string[];
    /** Files actually opened and pattern-matched. */
    filesScanned: number;
    /** Directories actually listed. */
    dirsScanned: number;
}
export declare function createScanCoverage(): ScanCoverage;
/** True when some part of the tree was not examined, for any reason. */
export declare function scanWasIncomplete(c: ScanCoverage): boolean;
/** True when the scanner hit a hard failure (not merely a configured limit). */
export declare function scanHadErrors(c: ScanCoverage): boolean;
/** Human-readable lines describing every gap in coverage. Empty when complete. */
export declare function describeScanGaps(c: ScanCoverage): string[];
export declare function findSecretsInDir(dir: string, depthLimit: number, baseDir: string, findings: SecretFinding[], coverage?: ScanCoverage): void;
//# sourceMappingURL=security-scan-secrets.d.ts.map