Read-only checker for local scanner-result and approval-baseline exports. It never scans source, stores secret matches, or rewrites a baseline. Node.js 22+, zero dependencies. src/index.mjs exports auditBaseline(scanner, baseline, policy, {now, deadline}) and TOOLID.
This walkthrough uses the tool's public README and checked-in example files. Run the command from a repository checkout with Node.js 22+.
Run the checked-in example
node bin/secret-scan-baseline-manager.mjs --root examples --policy policy.json --scanner scanner.json --baseline passing-baseline.json
node bin/secret-scan-baseline-manager.mjs --root examples --policy policy.json --scanner scanner.json --baseline failing-baseline.jsonRead the result
The synthetic examples exit 0 and 1. --help prints usage to stderr; normal runs print a bounded human summary to stderr. Stdout contains only the v1 JSON report.