trufflehog scans files outside defined sources

[thelittlebug]

Describe the bug
i activated trufflehog and it finds secrets in my .envrc.
this is a vague description of my project layout:

/
  src/
    python/
      project1/
        BUILD
      project2/
        BUILD
    shell/
    javascript/
.envrc
pants.toml

there is no BUILD file in the root of my monorepo, so i would expect trufflehog to ignore my .envrc file

Pants version
2.24

OS
im using arch btw... :D

[lilatomic]

Trufflehog is a bit of a special linter, in that it doesn't use targets and uses a pathglob instead. It's using "**" which will pull in everything. I thought that wouldn't pull in files ignored by gitignore and Pants's [GLOBAL].pants_ignore, but apparently not. src

As a workaround, you could specify ".envrc" in the [trufflehog].exclude setting