skarbiec health

Invocation#

skarbiec health [--field <field>] [--breached] [--saved-versions]

Purpose#

Find one secret kept in several places, secrets shorter than the policy allows and, when asked, secrets seen in known breaches, across every live item. duplicates compares whole payloads, so one password shared by a login and a host account passes it; this compares the one field.

Required inputs and options#

• No positional input. --field names the field compared and defaults to password. The length rule is the vault policy's min_generated_length; with none set, no item is reported short. --breached also asks the Have I Been Pwned range API about each distinct value, once however many items hold it, sending only the SHA-1 prefix. --saved-versions also opens every saved version of every live item and compares its field with the values held now.

Output and state effects#

• Opens every live item, compares SHA-256 digests of the field's text in memory, decides each value against every vault policy rule as policy check does, appends a health audit entry with the counts, and prints ok, field, checked (how many items hold the field), reused (groups of item ids that share one value), min_generated_length, short (ids below it), below_policy (each item whose value fails any configured rule, with the keys it failed in failed), unreadable (each item that would not open, with its error), breach_checked, breached (groups of item ids whose value was seen, with seen_count), breach_not_checked (groups the API could not be asked about, with curl's sentence), insecure_addresses (each item whose context url or urls names an http:// address, with those addresses: what is typed there travels without TLS), same_account (each site where more than one item holds the same username, regardless of case, with those items: one account kept twice, which autofill offers twice), breaks_site_rules (each login keeping password rules for its site, as password rules records them, whose value breaks them, with every rule broken in broken — minlength, maxlength, required, max-consecutive, or a character outside the classes required and allowed name: the site may refuse it at the next change, and generate --rules-of <id> --into <id> --field password replaces it with one that follows them), saved_versions_checked, reused_retired (with --saved-versions: each live item holding a value an item gave up, with retired_in, the item that gave it up, and at, the stamp of the saved version that held it — another item's retired password, or, when retired_in is the item itself, a value it changed away from and brought back) and saved_versions_unreadable (each saved version that would not open, with its item, stamp and error). No value, username, digest or length is printed. ok is true only when nothing is reused, short, below the policy, unreadable, breached, left unchecked, signed into without TLS, kept twice, breaking its site's rules or reusing a retired value. The operator API answers the same at POST /v1/operator/health with optional field, breached and saved-versions.

Refusals#

• Fails when the vault cannot be opened. An item that cannot be decrypted is reported in unreadable with the decryption error rather than skipped, as is a login whose recorded password rules are not in the Password Rules language, and a value the range API could not be asked about is reported in breach_not_checked rather than counted as clean, so a clean report never hides what it could not check.