add learned confidence classifier to cut generic-detector false positives

[doofzoff]

what

Adds an opt-in learned confidence refiner that cuts false positives from generic, format-agnostic detectors.

high_entropy catches unknown-format keys, but it also fires on benign high-entropy strings: UUIDs, git SHAs, digests, object ids, and slugs. This adds a small classifier that tells real secrets from look-alikes and nudges the confidence score. Paired with minConfidence, the noise drops out.

const noisy = 'id 9fceb02d0ae598e95dc970b74767f19372d61af8 tok Zx9Kq2Lm7Pv4Rt6Wy8Bn3Cf5Hj1Dg0As7Uv';

scan(noisy, { enable: ['high_entropy'] });
// git SHA and the unknown-format token both flagged at a flat 60%

scan(noisy, { enable: ['high_entropy'], refineConfidence: true, minConfidence: 0.5 });
// the SHA is gone; the token survives (refined up to 80%)

how

• src/ml.ts + src/confidence-model.ts — logistic regression over cheap character features (Shannon entropy, character-class mix, structure, and nearby labels like api_key= or commit). Trained offline, shipped as fixed weights.
• No new runtime dependency. Inference is one feature pass plus a dot product: synchronous, deterministic, safe on edge and in the browser. No model download, no native add-on.
• scripts/train-confidence-model.mjs — the reproducible trainer (seeded PRNG). Re-running with --write reproduces src/confidence-model.ts byte for byte. Holdout: precision 99.05%, recall 98.55%, accuracy 98.80% (n=4000).
• Integration is conservative. Only detectors marked refine are affected (currently just high_entropy); checksum-validated detectors (cards, IBANs, national ids) are never touched. refineConfidence is off by default, so existing behavior is unchanged.
• Exposes secretProbability / extractFeatures from the package root and the new flare-redact/ml subpath, plus a --refine-confidence CLI flag.

scope / honesty

This is a linear model trained on synthetic data, not a silver bullet. It targets one concrete pain point (high-entropy noise) without pulling in an ML runtime, which keeps the zero-dependency guarantee intact.

tests

test/ml.test.mjs (9 cases) covers the model, the engine integration, the untouched checksum path, and the default-off behavior. Full suite: 162/162 passing. README and CHANGELOG updated.