Repository navigation
feat(redact): cover UUIDs and blockchain credentials - #390
Merged
Merged
Conversation
Protect UUIDs, raw wallet key and hash shapes, validated wallet encodings, and named trading credentials before forwarding model requests. Preserve JSON boundaries, reversible placeholders, rule actions and exceptions, and keep public identifiers out of credential exfiltration evidence.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
UUID-shaped API credentials, unwrapped wallet keys and opaque trading credentials could reach upstream models without consistent coverage.
Adds 11 default-enabled replacement rules for UUIDs, raw 32-byte hex values, Solana/Sui/Stellar/XRP private material, blockchain accounts and extended public keys, wallet secret fields, trading authentication, keystores and RPC URL credentials. Extends SLIP-0132 private-key versions and validates their private payloads. Exchange, Polymarket CLOB/Builder/Relayer and predict.fun credentials use field/header context instead of invented token lengths.
UUIDs also cover ordinary order/trace IDs and compact 32-hex identifiers. Raw hex values deliberately include indistinguishable transaction hashes. Public identifiers do not independently trigger credential-exfiltration blocking. Wallet secrets and the new credential fields are fully masked in findings.
Keeps observation mode, per-rule actions, exceptions, saved-secret priority, streaming restoration and cache/full-scan agreement. Uses the existing bilingual catalog and code matcher, without changing the control API. Numeric JSON values and protocol fields retain their existing boundaries; byte-array keypairs are covered when pasted as text. Coverage and limits are documented in
docs/security/blockchain-redaction.zh-CN.md.Validation: