What the scanner finds

Before you start

• You have run one scan (Overview).

Matches

The scanner searches all of the team's flag keys at once, archived flags included. Matching is exact and case-sensitive. A match counts only when the characters on both sides cannot continue the key, so new-checkout is not found inside new-checkout-v2.

Keys in comments and inside longer strings are not reported. Keys shorter than 5 characters are reported only as SDK calls, and the scan prints a warning that names them. Keys built at run time, such as "checkout-" + version, cannot be found.

Paths that look like tests are marked Test. At most 200 references per key and branch are uploaded.

Aliases

A constant that holds a key is an alias, for example static final String CHECKOUT = "new-checkout" in Java, const CHECKOUT = 'new-checkout' in JavaScript or TypeScript, or CHECKOUT = "new-checkout" in Python. The scanner also knows the Kotlin, Go, Rust and C# forms. Each use of CHECKOUT in the repository is then reported as an alias of new-checkout.

Aliases are followed one level: a constant set to another constant is not followed. A name used for two different keys is skipped, with a warning. Plain lower-case names such as key or flag are not followed, because they are usually local variables; the name needs an upper-case letter, _ or $.

Files the scanner skips

• Files listed in .gitignore.
• Binary files and files over 1 MiB.
• node_modules, vendor, target, dist, build, minified *.min.js files and lock files.

Config file

Add .fluxgate/code-refs.toml to the repository:

exclude = ["generated/**", "docs/**"]   # paths to skip
stoplist = ["beta"]                     # keys never searched
context_lines = 0                       # 0 to 5
redact = ["internal-[0-9]+"]            # more patterns to redact
alias_styles = ["SCREAMING_SNAKE"]      # also search NEW_CHECKOUT for new-checkout

[[patterns]]                            # your own call shape
files = "**/*.rb"
regex = 'Flags\.enabled\?\(:{key}\)'

[[projects]]                            # a monorepo project
name = "checkout"
paths = ["services/checkout/**"]

• [[patterns]] adds a call shape for files that match files. The regular expression must contain {key} once. A match counts only when the text at {key} is exactly one of your flag keys.
• alias_styles searches forms of each key without a constant: SCREAMING_SNAKE, camelCase, PascalCase and snake_case. These forms find more false matches, so they are off unless you list them.
• [[projects]] names the project of each reference. The feature page groups files by project.
• A key the scanner does not know stops the scan with an error, so a typo does not go unnoticed.

What leaves your network

The scanner sends the repository name, branch, commit, and for each match the file path, line, kind, test mark and the context lines. The context is the matched line plus the configured number of lines above and below it, each cut to 200 characters.

• Before upload, secrets in context lines become [REDACTED]: cloud access key ids, private key headers, JWT-shaped tokens, values of assignments whose name contains password, secret, token or api_key, passwords in URLs such as postgres://user:password@host, and long random-looking strings. Add your own patterns with redact.
• User names, passwords and tokens in the git remote URL are never sent.
• To send no code at all, set FLUXGATE_CONTEXT_LINES to 0. On a hosted FluxGate, this is the recommended setting.

What the evaluation counts include

The Last evaluated time and evaluation counts next to the code references come from the evaluations that edge servers record. An OFREP bulk request counts once for every flag it returns, so an app that polls bulk makes every enabled flag of its team look evaluated. Reads of a disabled flag are not counted.