name	honeybadger-dev
description	How to add a scanner, lockfile parser, or rule to HoneyBadger, plus the test-fixture and self-check requirements. Use when extending scanners or contributing to honeybadger.

HoneyBadger — extending scanners

New scanner = its own package under internal/scanner/<name>/.
Register it in internal/engine/engine.go (scanner list + verdict weighting).
Ship a matching fixture in internal/testfixture/ — fixtures build secrets at runtime (never hardcoded) so GitHub push protection doesn't reject the push.

New lockfile parser (Cargo.lock, pnpm-lock.yaml, poetry.lock): add in internal/scanner/cve/deps.go.
New supply-chain rule / secret pattern: add YAML under rules/ (embedded via rules/embed.go).
Typosquat dictionary entries: internal/scanner/supplychain.
New test fixture: add to internal/testfixture/ with secrets built at runtime.

make build · make test · make self-check (scans itself) · go test -tags integration ./.... Open the PR against main.

name	honeybadger-dev
description	How to add a scanner, lockfile parser, or rule to HoneyBadger, plus the test-fixture and self-check requirements. Use when extending scanners or contributing to honeybadger.

New scanner = its own package under internal/scanner/<name>/.
Register it in internal/engine/engine.go (scanner list + verdict weighting).
Ship a matching fixture in internal/testfixture/ — fixtures build secrets at runtime (never hardcoded) so GitHub push protection doesn't reject the push.

New lockfile parser (Cargo.lock, pnpm-lock.yaml, poetry.lock): add in internal/scanner/cve/deps.go.
New supply-chain rule / secret pattern: add YAML under rules/ (embedded via rules/embed.go).
Typosquat dictionary entries: internal/scanner/supplychain.
New test fixture: add to internal/testfixture/ with secrets built at runtime.

make build · make test · make self-check (scans itself) · go test -tags integration ./.... Open the PR against main.

honeybadger-dev