* feat: iterative decoding pipeline with configurable depth
Decoders (base64, UTF-16, escaped unicode) now chain iteratively:
each decoder's output is fed back through all decoders until no new
transformations occur or --max-decode-depth is reached (default: 5).
This finds secrets hidden inside layered encodings, e.g. a base64
Docker auth blob containing a GCP private key, or a UTF-16 file
with base64-encoded credentials.
At depth=1 behavior is identical to the previous implementation.
Extra depths exit early when no new data is produced, so the cost
is <5% wall time on a large repo scan.
Co-authored-by: Dylan Ayrey <dxa4481@rit.edu>
* docs: iterative decoding performance data
Co-authored-by: Dylan Ayrey <dxa4481@rit.edu>
* comment: explain why PLAIN decoder is skipped at depth > 0
Co-authored-by: Dylan Ayrey <dxa4481@rit.edu>
* refactor: extract iterativeDecode, address review feedback
- Extract decode loop into standalone iterativeDecode() function,
separating decoding from channel dispatch (rosecodym, camgunz).
- Drop decodeInput struct, use []byte directly (camgunz).
- Remove redundant maxDepth clamp from scannerWorker (camgunz).
- Inline decoderType variable (camgunz).
- Replace byteSliceSeen with slices.ContainsFunc (camgunz).
Co-authored-by: Dylan Ayrey <dxa4481@rit.edu>
* fix: remove unused decodeLatency metric (lint)
Co-authored-by: Dylan Ayrey <dxa4481@rit.edu>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
