# runtime/entrypoints/credential.entrypoint.ts

> 27 lines of code and 5 definitions.

Tree: Project Scripts
Language: typescript
Layer: runtime
Canonical: https://banes-lab.com/anatomy/scripts#file-scripts-runtime-entrypoints-credential-entrypoint-ts
Source text: https://banes-lab.com/source/scripts/runtime/entrypoints/credential.entrypoint.ts.txt

Listed in [runtime/entrypoints](https://banes-lab.com/api/source/scripts/runtime/entrypoints.md), after [runtime/entrypoints/coverage.entrypoint.ts](https://banes-lab.com/source/scripts/runtime/entrypoints/coverage.entrypoint.ts.md) and before [runtime/entrypoints/dependency.entrypoint.ts](https://banes-lab.com/source/scripts/runtime/entrypoints/dependency.entrypoint.ts.md).

## Definitions

- `excluded` (lexical_declaration, line 18)
- `detectors` (lexical_declaration, line 19)
- `files` (lexical_declaration, line 20)
- `findings` (lexical_declaration, line 24)
- `verdict` (lexical_declaration, line 27)

## Contained in

- [runtime/entrypoints](https://banes-lab.com/anatomy/scripts/folder-scripts-runtime-entrypoints.md)

## Enforces

- [Secrets Management](https://banes-lab.com/records/architecture/secrets-management.md)

## Detector for

- [Hardcoded Configuration](https://banes-lab.com/records/architecture/hardcoded-configuration.md)
- [Secret Sprawl](https://banes-lab.com/records/architecture/secret-sprawl.md)

## Source

```typescript
import { CREDENTIAL_EXCLUSIONS, CREDENTIAL_EXTENSIONS } from "#configuration/constants/credential.constants";
import { ROOT, absolutePath } from "@ssot/paths";
import { credentialFindings } from "#core/analyzers/credential.analyzer";
import { credentialVerdict } from "#core/validators/credential.validator";
import { defineCheck } from "@govlab/context/check";
import { includedFilesUnder } from "#core/loaders/source.loader";
import { loadDetectors } from "@ssot/secrets";
import { normalizePath } from "@ssot/govlab/shared/resolvers/anchor.resolver.ts";
import process from "node:process";
import { readFileSync } from "node:fs";
import { relative } from "node:path";

defineCheck({
    detects: ["architecture:hardcoded-configuration", "architecture:secret-sprawl"],
    enforces: ["architecture:secrets-management"],
});

const excluded = CREDENTIAL_EXCLUSIONS.map((exclusion) => absolutePath(exclusion.key));
const detectors = await loadDetectors();
const files = [
    ...includedFilesUnder(ROOT, CREDENTIAL_EXTENSIONS),
    ...includedFilesUnder(absolutePath("methodology.root"), CREDENTIAL_EXTENSIONS),
].filter((file) => !excluded.some((folder) => file.startsWith(folder)));
const findings = files.flatMap((file) =>
    credentialFindings(normalizePath(relative(ROOT, file)), readFileSync(file, "utf8"), detectors),
);
const verdict = credentialVerdict(findings, files.length);
process.stdout.write(verdict.text);
process.exitCode = verdict.held ? 0 : 1;
```