What causes " - ${result.filePath}: ${issueCount} ${issueText} detected" in yamadashy/repomix?

Read the count and locate the flagged file/diff, then rotate or remove the exposed credential

- ${result.filePath}: ${issueCount} ${issueText} detected

Error message

  - ${result.filePath}: ${issueCount} ${issueText} detected

What it means

The per-result detail line of the same logSuspiciousContentWarning: for each suspicious Git diff/log entry it logs the file path (or diff/log identifier) and the number of suspicious pattern matches found in it. Like error 120 it is a warning, not a thrown exception; it exists so users can locate exactly which diff/log content triggered the security scan and how many issues were detected there.

Source

Thrown at src/core/security/validateFileSafety.ts:63

  return {
    safeRawFiles,
    safeFilePaths,
    suspiciousFilesResults,
    suspiciousGitDiffResults,
    suspiciousGitLogResults,
  };
};

const logSuspiciousContentWarning = (contentType: string, results: SuspiciousFileResult[]) => {
  if (results.length === 0) {
    return;
  }

  logger.warn(`Security issues found in ${contentType}, but they will still be included in the output`);
  for (const result of results) {
    const issueCount = result.messages.length;
    const issueText = issueCount === 1 ? 'issue' : 'issues';
    logger.warn(`  - ${result.filePath}: ${issueCount} ${issueText} detected`);
  }
};

View on GitHub (pinned to f465ad9093)

Solutions

Read the count and locate the flagged file/diff, then rotate or remove the exposed credential
Run a focused scan (gitleaks detect) on the named file to see the actual matched strings
Use --include with narrower globs to omit the flagged files from the pack
Suppress only after verifying false positive via --no-security-check

Example fix

// before: flagged file stays in pack
repomix --include-logs
// after: exclude the flagged path pattern
repomix --include-logs --ignore '**/credentials.ts'

Defensive patterns

Strategy: validation

Validate before calling

const flagged = results.filter(r => (r.type === 'gitDiff' || r.type === 'gitLog') && r.messages.length > 0);
for (const r of flagged) {
  console.error(`${r.filePath}: ${r.messages.length} security issue(s)`);
  r.messages.forEach(m => console.error('  match:', m));
}
if (flagged.length) process.exit(1);

Type guard

const isSuspiciousGitContent = (r: unknown): r is SuspiciousFileResult & { type: 'gitDiff' | 'gitLog' } =>
  typeof r === 'object' && r !== null &&
  'type' in r && ((r as { type: string }).type === 'gitDiff' || (r as { type: string }).type === 'gitLog') &&
  'messages' in r && Array.isArray((r as { messages: unknown }).messages) &&
  (r as { messages: unknown[] }).messages.length > 0;

Prevention

Parse the per-file issue counts from the warning output (or the returned suspicious results) and fail CI when any count > 0
Inspect the matched patterns per file with a dedicated secret scanner to decide fix vs false positive
Exclude persistently flagged paths via repomix ignore patterns rather than disabling the whole security check
Keep commit messages free of tokens and credentials, since git log content is scanned too
Educate the team: this line is a locator — always resolve the named file before sharing the packed output

When it happens

Trigger: Same as error 120: security check enabled while including git diffs/logs, and at least one result entry has messages.length >= 1; the loop emits one line per SuspiciousFileResult with its filePath and message count.

Common situations: A single large diff touching many files accumulates multiple suspicious matches (e.g. 5 detected); a commit message containing a pasted token in git log output; reviewing CI logs of a repomix run to find which files need scrubbing.

Related errors

AI-assisted analysis of yamadashy/repomix@f465ad9093 (2026-08-29). Data as JSON: /api/errors/4ec3ab0a98c8a91d. Report an issue: GitHub.