Repository navigation
fix(security): precise SEC001 rule and a fresh full-history baseline - #2107
Merged
Merged
Conversation
The history gate matched bare prefixes (ghp_, AKIA, sk_live_, PRIVATE
KEY-----) and any database URL with a password field, so it flagged
secret detectors, test fakes, warning docs, ${VAR} placeholders and dev
defaults; on the private integration tree 93 findings, all noise, hid
real signals.
- Two stages: an interval-free candidate ERE for git pickaxe/grep (keeps
git fast), then a precise in-process check: full-length GitHub tokens,
github_pat_, AWS key IDs (EXAMPLE keys excluded), Stripe live keys, PEM
blocks with key material, DB URLs with a real literal password.
- Narrow filters: ascending 8-character runs mark hand-made fixtures; one
reviewed self-signed loopback test key is exempt by blob ID only.
- History counts introductions only (precise count rises in a commit).
- command_timeout_seconds 120 -> 300 (candidate pickaxe took 81 s on the
private tree).
- New baseline at b37ee3b over main, cla-signatures and tags: 17,061
commits, 369 findings (368 path classes, 1 credential tracked for
rotation), 0 current-tree findings (was 11). Full audit 533 s.
- Tests: 17 positive credential shapes built at runtime, 17 negative
false-positive classes, introduction vs removal, blob exemption bound to
content, strict rule contract. tests/security: 178 passed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LXrM9CHahK6TaGE4yuHGPx
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The history gate's SEC001 rule matched bare prefixes (
ghp_,AKIA,sk_live_,PRIVATE KEY-----) and any database URL with a password field. On the private integration tree it reported 93 findings — every one a secret detector, test fake, warning doc,${VAR}/{placeholder}password, local dev default or a self-signed loopback test key. The noise hid a real signal: the precise rule's full audit surfaced one live credential in an archive tag, now rotated and the tag deleted.Rule
git log -S/git grep(intervals made the pickaxe exceed the per-command timeout on the larger private tree); a precise in-process check decides — full-length GitHub tokens,github_pat_, AWS key IDs (…EXAMPLEexcluded), Stripe live keys, PEM blocks with base64 key material, DB URLs with a literal password ≥ 8 chars that is no placeholder and no documented dev default.command_timeout_seconds120 → 300 (candidate pickaxe 81 s on the private tree).load_policy.Baseline
Fresh audit at
b37ee3be11overmain,cla-signaturesand tags (the documented ref set; open PR branches excluded): 17,061 commits, 109,865 objects, 369 findings (368 IP path classes, 1 credential — rotated), current tree 0 (was 11). Full audit 533 s. Review doc updated, including the 8,818-commit discrepancy of the evidence shipped with 3.11.0.Tests
17 positive credential shapes built at runtime, 17 negative false-positive classes, introduction vs removal, blob exemption bound to content, interval-free ERE, strict contract.
tests/security: 178 passed. Gate on this branch: 0 new findings. Private integration tree: 0 of the previous 93 remain.🤖 Generated with Claude Code
https://claude.ai/code/session_01LXrM9CHahK6TaGE4yuHGPx