Clarification on Committer in JSON Lines output:

[tpat13]

When scanning either the entire git history or scanning a specific branch, will the committer_name from the jsonl output be the last person who committed to the particular file or the actual person who committed the secret?

Or is this why there is the distinction between author_name and committer_name: author - the one who originally committed the secret, and committer - the last person to commit to the file?

[bradlarsen]

@tpat13 good questions. The committer_name and author_name correspond to the commit with ID commit_id.

When Nosey Parker finds a match in a Git repository, it computes the first commit in which the matching content was introduced. So it should be the person who committed the secret, not the person who last touched that file.

The distinction between author_name and committer_name comes from Git, which represents those two things separately: https://stackoverflow.com/questions/6755824/what-is-the-difference-between-author-and-committer-in-git. The author_name is probably the more relevant field as far as who actually wrote the code. Though if you were thinking of some workflow where Nosey Parker findings get turned into issue tracker issues (e.g., Jira) and assigned to a person, it's probably reasonable to include both the author and committer in the issue.

[tpat13]

Awesome, thanks for the detailed answer Brad!